# Flog Txt Version 1
# Analyzer Version: 3.2.2
# Analyzer Build Date: Jun  3 2020 08:38:37
# Log Creation Date: 17.09.2020 08:47:03.530

Process:
	id = "1"
	image_name = "000005.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\000005.exe"
	page_root = "0x3d77d000"
	os_pid = "0x7b0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x454"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\000005.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x57c

	[0050.515] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000
	[0050.534] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222
	[0050.534] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0
	[0050.535] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee
	[0050.535] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442
	[0050.535] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0
	[0050.535] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2
	[0050.536] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950
	[0050.536] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18
	[0050.536] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10
	[0050.537] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223
	[0050.537] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameW") returned 0x76d4dd0e
	[0050.537] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameA") returned 0x76d5b6e0
	[0050.538] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c
	[0050.538] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700
	[0050.538] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b
	[0050.539] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809
	[0050.539] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136
	[0050.539] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371
	[0050.539] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c
	[0050.540] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3
	[0050.540] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d
	[0050.540] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76d41916
	[0050.540] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff
	[0050.541] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270
	[0050.541] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3
	[0050.541] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c
	[0050.542] GetProcAddress (hModule=0x76d30000, lpProcName="OpenMutexW") returned 0x76d45151
	[0050.542] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0
	[0050.542] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220
	[0050.542] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiW") returned 0x76d5d5cd
	[0050.543] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiA") returned 0x76d43e8e
	[0050.543] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5
	[0050.543] GetProcAddress (hModule=0x76d30000, lpProcName="ReleaseMutex") returned 0x76d4111e
	[0050.544] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410
	[0050.544] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467
	[0050.544] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5
	[0050.545] GetProcAddress (hModule=0x76d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x76d44173
	[0050.545] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725
	[0050.546] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0
	[0050.546] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8
	[0050.546] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7
	[0050.547] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860
	[0050.547] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282
	[0050.547] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807
	[0050.547] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e
	[0050.548] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435
	[0050.548] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9
	[0050.548] GetProcAddress (hModule=0x76d30000, lpProcName="HeapReAlloc") returned 0x77c81f6e
	[0050.549] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026
	[0050.549] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9
	[0050.549] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b
	[0050.550] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c
	[0050.550] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d
	[0050.550] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca
	[0050.551] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringA") returned 0x76d43c5a
	[0050.551] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986
	[0050.551] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802
	[0050.552] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96
	[0050.552] GetProcAddress (hModule=0x76d30000, lpProcName="SystemTimeToFileTime") returned 0x76d45a7e
	[0050.552] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0
	[0050.552] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f
	[0050.553] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c
	[0050.553] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf
	[0050.553] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000
	[0055.328] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d
	[0055.329] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExW") returned 0x777246ad
	[0055.329] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6
	[0055.329] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d
	[0055.330] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304
	[0055.330] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c
	[0055.330] GetProcAddress (hModule=0x77710000, lpProcName="OpenSCManagerW") returned 0x7771ca64
	[0055.330] GetProcAddress (hModule=0x77710000, lpProcName="OpenServiceW") returned 0x7771ca4c
	[0055.331] GetProcAddress (hModule=0x77710000, lpProcName="CloseServiceHandle") returned 0x7772369c
	[0055.331] GetProcAddress (hModule=0x77710000, lpProcName="ControlService") returned 0x77737144
	[0055.331] GetProcAddress (hModule=0x77710000, lpProcName="QueryServiceStatus") returned 0x77722a86
	[0055.332] GetProcAddress (hModule=0x77710000, lpProcName="EnumDependentServicesW") returned 0x77711e3a
	[0055.332] GetProcAddress (hModule=0x77710000, lpProcName="EnumServicesStatusExW") returned 0x7771b466
	[0055.332] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000
	[0059.503] GetProcAddress (hModule=0x77130000, lpProcName="SystemParametersInfoW") returned 0x771490d3
	[0059.503] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x759d0000
	[0065.622] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteExW") returned 0x759f1e46
	[0065.623] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c40000
	[0065.623] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0
	[0065.624] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x75660000
	[0065.858] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6
	[0065.859] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06
	[0065.859] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058
	[0065.859] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77230000
	[0066.387] GetProcAddress (hModule=0x77230000, lpProcName="WSAStartup") returned 0x77233ab2
	[0066.387] GetProcAddress (hModule=0x77230000, lpProcName="socket") returned 0x77233eb8
	[0066.388] GetProcAddress (hModule=0x77230000, lpProcName="send") returned 0x77236f01
	[0066.388] GetProcAddress (hModule=0x77230000, lpProcName="recv") returned 0x77236b0e
	[0066.389] GetProcAddress (hModule=0x77230000, lpProcName="connect") returned 0x77236bdd
	[0066.389] GetProcAddress (hModule=0x77230000, lpProcName="closesocket") returned 0x77233918
	[0066.390] GetProcAddress (hModule=0x77230000, lpProcName="gethostbyname") returned 0x77247673
	[0066.390] GetProcAddress (hModule=0x77230000, lpProcName="inet_addr") returned 0x7723311b
	[0066.391] GetProcAddress (hModule=0x77230000, lpProcName="ntohl") returned 0x77232d57
	[0066.391] GetProcAddress (hModule=0x77230000, lpProcName="htonl") returned 0x77232d57
	[0066.391] GetProcAddress (hModule=0x77230000, lpProcName="htons") returned 0x77232d8b
	[0066.392] GetProcessHeap () returned 0x2e0000
	[0066.393] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x20) returned 0x2f40c8
	[0066.393] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=18681270561) returned 1
	[0066.393] GetTickCount () returned 0x1148325
	[0066.394] GetCurrentProcessId () returned 0x7b0
	[0066.398] GetTickCount () returned 0x1148334
	[0066.399] GetTickCount () returned 0x1148334
	[0066.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x20) returned 0x2f40f0
	[0066.399] GetVersion () returned 0x1db10106
	[0066.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x7) returned 0x2e36b0
	[0066.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x2f0bd0
	[0066.400] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f0bd0, Size=0x20) returned 0x2f4140
	[0066.400] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4140, Size=0x40) returned 0x2f46b0
	[0066.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x2f4900
	[0066.401] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_829UVIA") returned 0x0
	[0066.402] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_829UVIA") returned 0x84
	[0066.402] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e36b0 | out: hHeap=0x2e0000) returned 1
	[0066.402] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0066.402] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f46b0 | out: hHeap=0x2e0000) returned 1
	[0066.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x7) returned 0x2e36b0
	[0066.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x2f0bd0
	[0066.403] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f0bd0, Size=0x20) returned 0x2f4140
	[0066.403] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4140, Size=0x40) returned 0x2f46b0
	[0066.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x304908
	[0066.404] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_829UVIU") returned 0x0
	[0066.404] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_829UVIU") returned 0x88
	[0066.405] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e36b0 | out: hHeap=0x2e0000) returned 1
	[0066.405] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0066.405] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f46b0 | out: hHeap=0x2e0000) returned 1
	[0066.405] GetVersion () returned 0x1db10106
	[0066.405] GetCurrentProcess () returned 0xffffffff
	[0066.405] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1
	[0066.406] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1
	[0066.406] CloseHandle (hObject=0x8c) returned 1
	[0066.406] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0
	[0066.407] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0
	[0066.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x2e36b0
	[0066.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x2f0bd0
	[0066.407] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f0bd0, Size=0x20) returned 0x2f4140
	[0066.407] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4140, Size=0x40) returned 0x2f46b0
	[0066.407] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f46b0, Size=0x80) returned 0x2f46b0
	[0066.408] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f46b0, Size=0x100) returned 0x2f46b0
	[0066.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x34) returned 0x2f47b8
	[0066.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f07c0
	[0066.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f07d0
	[0066.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f07e0
	[0066.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0bd0
	[0066.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f47f8
	[0066.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0be8
	[0066.409] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f47f8, Size=0x8) returned 0x2f47f8
	[0066.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0c00
	[0066.409] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f47f8, Size=0x10) returned 0x2f47f8
	[0066.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c18
	[0066.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c30
	[0066.410] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f47f8, Size=0x20) returned 0x2f47f8
	[0066.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0c48
	[0066.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c60
	[0066.410] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07c0, Size=0x8) returned 0x2f07c0
	[0066.410] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07d0, Size=0x8) returned 0x2f07d0
	[0066.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4820
	[0066.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0c78
	[0066.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4830
	[0066.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c90
	[0066.411] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4830, Size=0x8) returned 0x2f4830
	[0066.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314928
	[0066.411] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4830, Size=0x10) returned 0x2f4830
	[0066.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314940
	[0066.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4848
	[0066.412] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4830, Size=0x20) returned 0x2f4858
	[0066.412] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07c0, Size=0x10) returned 0x2f4830
	[0066.412] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07d0, Size=0x10) returned 0x2f4880
	[0066.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f07c0
	[0066.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314958
	[0066.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f07d0
	[0066.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314970
	[0066.412] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07d0, Size=0x8) returned 0x2f07d0
	[0066.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4898
	[0066.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314988
	[0066.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f48a8
	[0066.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3149a0
	[0066.413] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f48a8, Size=0x8) returned 0x2f48a8
	[0066.413] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4830, Size=0x20) returned 0x314d10
	[0066.414] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4880, Size=0x20) returned 0x314d38
	[0066.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4880
	[0066.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3149b8
	[0066.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4830
	[0066.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3149d0
	[0066.414] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4830, Size=0x8) returned 0x2f4830
	[0066.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x314d60
	[0066.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x314d80
	[0066.415] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0066.415] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f46b0 | out: hHeap=0x2e0000) returned 1
	[0066.415] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0
	[0066.436] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3149e8
	[0066.436] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3149e8, Size=0x20) returned 0x2f4348
	[0066.436] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4348, Size=0x40) returned 0x2f4708
	[0066.437] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x80) returned 0x2f4708
	[0066.437] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x100) returned 0x315058
	[0066.437] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3149e8
	[0066.437] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3149e8, Size=0x20) returned 0x2f4348
	[0066.437] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4348, Size=0x40) returned 0x2f4708
	[0066.437] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x80) returned 0x2f4708
	[0066.438] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x100) returned 0x315160
	[0066.438] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3149e8
	[0066.438] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4708
	[0066.438] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.438] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x8) returned 0x2f4708
	[0066.438] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x2f4718
	[0066.438] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x10) returned 0x2f4738
	[0066.439] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x2f4750
	[0066.439] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x2f4348
	[0066.439] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4738, Size=0x20) returned 0x2f4770
	[0066.439] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1c) returned 0x2f4370
	[0066.439] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x2f4798
	[0066.439] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x2f4398
	[0066.440] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314a18
	[0066.440] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4708
	[0066.440] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40) returned 0x315268
	[0066.440] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x8) returned 0x2f4708
	[0066.440] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x3c) returned 0x3152b0
	[0066.440] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4708, Size=0x10) returned 0x2f4738
	[0066.441] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x3152f8
	[0066.441] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x315318
	[0066.441] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4738, Size=0x20) returned 0x315338
	[0066.441] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x315360
	[0066.441] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0066.441] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315058 | out: hHeap=0x2e0000) returned 1
	[0066.441] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0066.442] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315160 | out: hHeap=0x2e0000) returned 1
	[0066.442] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3158e0
	[0066.449] EnumServicesStatusExW (in: hSCManager=0x3158e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0
	[0066.451] GetLastError () returned 0xea
	[0066.451] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x11e4) returned 0x3191e0
	[0066.452] EnumServicesStatusExW (in: hSCManager=0x3158e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3191e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3191e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1
	[0066.454] CloseServiceHandle (hSCObject=0x3158e0) returned 1
	[0066.494] lstrlenW (lpString="Appinfo") returned 7
	[0066.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0066.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0066.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0066.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0066.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0066.495] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0066.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0066.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0066.496] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0066.496] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0066.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0066.496] lstrlenW (lpString="AudioSrv") returned 8
	[0066.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0066.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0066.497] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0066.497] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0066.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0066.497] lstrlenW (lpString="BFE") returned 3
	[0066.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0066.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0066.498] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0066.498] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0066.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0066.498] lstrlenW (lpString="CryptSvc") returned 8
	[0066.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0066.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0066.499] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0066.499] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0066.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0066.499] lstrlenW (lpString="CscService") returned 10
	[0066.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0066.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0066.500] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0066.500] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0066.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0066.500] lstrlenW (lpString="DcomLaunch") returned 10
	[0066.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0066.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0066.501] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0066.501] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0066.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0066.501] lstrlenW (lpString="Dhcp") returned 4
	[0066.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0066.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0066.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0066.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0066.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0066.502] lstrlenW (lpString="Dnscache") returned 8
	[0066.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0066.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0066.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0066.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0066.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0066.503] lstrlenW (lpString="DPS") returned 3
	[0066.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0066.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0066.504] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0066.504] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0066.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0066.504] lstrlenW (lpString="eventlog") returned 8
	[0066.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0066.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0066.505] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0066.505] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0066.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0066.505] lstrlenW (lpString="EventSystem") returned 11
	[0066.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0066.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0066.506] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0066.506] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0066.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0066.506] lstrlenW (lpString="gpsvc") returned 5
	[0066.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0066.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0066.507] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0066.507] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0066.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0066.507] lstrlenW (lpString="iphlpsvc") returned 8
	[0066.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0066.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0066.507] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0066.508] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0066.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0066.508] lstrlenW (lpString="LanmanServer") returned 12
	[0066.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0066.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0066.508] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0066.508] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0066.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0066.509] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0066.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0066.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0066.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0066.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0066.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0066.510] lstrlenW (lpString="lmhosts") returned 7
	[0066.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0066.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0066.510] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0066.510] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0066.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0066.511] lstrlenW (lpString="MMCSS") returned 5
	[0066.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0066.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0066.511] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0066.511] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0066.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0066.511] lstrlenW (lpString="MpsSvc") returned 6
	[0066.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0066.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0066.512] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0066.512] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0066.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0066.512] lstrlenW (lpString="Netman") returned 6
	[0066.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0066.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0066.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0066.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0066.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0066.513] lstrlenW (lpString="netprofm") returned 8
	[0066.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0066.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0066.514] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0066.514] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0066.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0066.514] lstrlenW (lpString="NlaSvc") returned 6
	[0066.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0066.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0066.515] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0066.515] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0066.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0066.515] lstrlenW (lpString="nsi") returned 3
	[0066.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0066.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0066.516] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0066.516] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0066.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0066.516] lstrlenW (lpString="PcaSvc") returned 6
	[0066.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0066.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0066.517] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0066.517] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0066.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0066.517] lstrlenW (lpString="PlugPlay") returned 8
	[0066.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0066.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0066.517] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0066.518] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0066.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0066.518] lstrlenW (lpString="Power") returned 5
	[0066.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0066.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0066.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0066.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0066.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0066.520] lstrlenW (lpString="ProfSvc") returned 7
	[0066.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0066.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0066.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0066.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0066.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0066.520] lstrlenW (lpString="RpcEptMapper") returned 12
	[0066.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0066.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0066.521] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0066.521] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0066.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0066.522] lstrlenW (lpString="RpcSs") returned 5
	[0066.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0066.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0066.522] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0066.522] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0066.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0066.523] lstrlenW (lpString="SamSs") returned 5
	[0066.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0066.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0066.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0066.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0066.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0066.524] lstrlenW (lpString="Schedule") returned 8
	[0066.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0066.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0066.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0066.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0066.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0066.525] lstrlenW (lpString="SENS") returned 4
	[0066.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0066.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0066.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0066.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0066.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0066.525] lstrlenW (lpString="ShellHWDetection") returned 16
	[0066.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0066.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0066.526] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0066.526] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0066.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0066.526] lstrlenW (lpString="Spooler") returned 7
	[0066.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0066.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0066.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0066.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0066.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0066.527] lstrlenW (lpString="SysMain") returned 7
	[0066.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0066.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0066.528] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0066.528] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0066.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0066.528] lstrlenW (lpString="Themes") returned 6
	[0066.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0066.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0066.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0066.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0066.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0066.529] lstrlenW (lpString="TrkWks") returned 6
	[0066.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0066.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0066.529] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0066.530] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0066.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0066.530] lstrlenW (lpString="UxSms") returned 5
	[0066.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0066.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0066.530] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0066.530] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0066.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0066.531] lstrlenW (lpString="WdiServiceHost") returned 14
	[0066.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0066.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0066.531] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0066.531] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0066.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0066.532] lstrlenW (lpString="WdiSystemHost") returned 13
	[0066.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0066.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0066.532] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0066.532] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0066.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0066.533] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0066.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0066.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0066.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0066.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0066.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0066.533] lstrlenW (lpString="Winmgmt") returned 7
	[0066.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0066.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0066.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0066.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0066.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0066.535] lstrlenW (lpString="WPDBusEnum") returned 10
	[0066.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0066.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0066.535] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0066.535] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0066.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0066.536] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3191e0 | out: hHeap=0x2e0000) returned 1
	[0066.536] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0
	[0066.550] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0066.552] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0066.553] lstrlenW (lpString="System") returned 6
	[0066.553] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0066.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0066.553] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0066.553] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0066.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0066.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0066.554] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0066.554] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0066.555] lstrlenW (lpString="smss.exe") returned 8
	[0066.555] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0066.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0066.556] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0066.556] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0066.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0066.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0066.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0066.556] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0066.558] lstrlenW (lpString="csrss.exe") returned 9
	[0066.558] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0066.558] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0066.558] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0066.558] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0066.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0066.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0066.559] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0066.559] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0066.560] lstrlenW (lpString="wininit.exe") returned 11
	[0066.560] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0066.560] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0066.561] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0066.561] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0066.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0066.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0066.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0066.561] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0066.563] lstrlenW (lpString="csrss.exe") returned 9
	[0066.563] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0066.563] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0066.563] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0066.563] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0066.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0066.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0066.564] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0066.566] lstrlenW (lpString="winlogon.exe") returned 12
	[0066.566] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0066.568] lstrlenW (lpString="services.exe") returned 12
	[0066.568] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0066.569] lstrlenW (lpString="lsass.exe") returned 9
	[0066.569] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0066.570] lstrlenW (lpString="lsm.exe") returned 7
	[0066.571] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.572] lstrlenW (lpString="svchost.exe") returned 11
	[0066.572] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.573] lstrlenW (lpString="svchost.exe") returned 11
	[0066.573] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.574] lstrlenW (lpString="svchost.exe") returned 11
	[0066.575] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.576] lstrlenW (lpString="svchost.exe") returned 11
	[0066.576] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.577] lstrlenW (lpString="svchost.exe") returned 11
	[0066.577] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0066.578] lstrlenW (lpString="audiodg.exe") returned 11
	[0066.578] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.579] lstrlenW (lpString="svchost.exe") returned 11
	[0066.580] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.581] lstrlenW (lpString="svchost.exe") returned 11
	[0066.581] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0066.582] lstrlenW (lpString="dwm.exe") returned 7
	[0066.583] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0066.584] lstrlenW (lpString="explorer.exe") returned 12
	[0066.584] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0066.585] lstrlenW (lpString="spoolsv.exe") returned 11
	[0066.585] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.586] lstrlenW (lpString="svchost.exe") returned 11
	[0066.587] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0066.588] lstrlenW (lpString="taskhost.exe") returned 12
	[0066.588] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0066.589] lstrlenW (lpString="taskeng.exe") returned 11
	[0066.589] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0066.590] lstrlenW (lpString="elliott grace.exe") returned 17
	[0066.590] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0066.591] lstrlenW (lpString="floyd.exe") returned 9
	[0066.592] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0066.593] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0066.593] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0066.594] lstrlenW (lpString="bond.exe") returned 8
	[0066.594] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0066.595] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0066.595] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0066.596] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0066.596] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0066.598] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0066.598] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0066.599] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0066.599] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0066.600] lstrlenW (lpString="wheel_year.exe") returned 14
	[0066.600] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0066.602] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0066.602] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0066.603] lstrlenW (lpString="alifilm.exe") returned 11
	[0066.603] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0066.604] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0066.604] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0066.605] lstrlenW (lpString="orchestra.exe") returned 13
	[0066.606] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0066.607] lstrlenW (lpString="decade.exe") returned 10
	[0066.607] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0066.608] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0066.608] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0066.609] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0066.609] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0066.610] lstrlenW (lpString="bracket das.exe") returned 15
	[0066.611] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0066.612] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0066.612] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0066.620] lstrlenW (lpString="3dftp.exe") returned 9
	[0066.621] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0066.622] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0066.622] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0066.624] lstrlenW (lpString="alftp.exe") returned 9
	[0066.624] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0066.625] lstrlenW (lpString="barca.exe") returned 9
	[0066.625] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0066.626] lstrlenW (lpString="bitkinex.exe") returned 12
	[0066.626] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0066.627] lstrlenW (lpString="coreftp.exe") returned 11
	[0066.628] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0066.629] lstrlenW (lpString="far.exe") returned 7
	[0066.629] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0066.630] lstrlenW (lpString="filezilla.exe") returned 13
	[0066.630] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0066.631] lstrlenW (lpString="flashfxp.exe") returned 12
	[0066.632] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0066.633] lstrlenW (lpString="fling.exe") returned 9
	[0066.633] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0066.634] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0066.634] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0066.635] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0066.635] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0066.636] lstrlenW (lpString="icq.exe") returned 7
	[0066.636] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0066.637] lstrlenW (lpString="leechftp.exe") returned 12
	[0066.637] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0066.638] lstrlenW (lpString="ncftp.exe") returned 9
	[0066.638] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0066.639] lstrlenW (lpString="notepad.exe") returned 11
	[0066.640] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0066.641] lstrlenW (lpString="operamail.exe") returned 13
	[0066.641] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0066.642] lstrlenW (lpString="outlook.exe") returned 11
	[0066.654] CloseHandle (hObject=0xe4) returned 1
	[0066.655] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0066.656] lstrlenW (lpString="pidgin.exe") returned 10
	[0066.656] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0066.658] lstrlenW (lpString="scriptftp.exe") returned 13
	[0066.658] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0066.672] lstrlenW (lpString="skype.exe") returned 9
	[0066.672] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0066.673] lstrlenW (lpString="smartftp.exe") returned 12
	[0066.674] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0066.675] lstrlenW (lpString="thunderbird.exe") returned 15
	[0066.675] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0066.677] lstrlenW (lpString="totalcmd.exe") returned 12
	[0066.677] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0066.678] lstrlenW (lpString="trillian.exe") returned 12
	[0066.679] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0066.680] lstrlenW (lpString="webdrive.exe") returned 12
	[0066.680] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0066.681] lstrlenW (lpString="whatsapp.exe") returned 12
	[0066.682] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0066.683] lstrlenW (lpString="winscp.exe") returned 10
	[0066.683] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0066.684] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0066.685] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0066.686] lstrlenW (lpString="active-charge.exe") returned 17
	[0066.686] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0066.688] lstrlenW (lpString="accupos.exe") returned 11
	[0066.688] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0066.689] lstrlenW (lpString="afr38.exe") returned 9
	[0066.689] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0066.690] lstrlenW (lpString="aldelo.exe") returned 10
	[0066.691] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0066.692] lstrlenW (lpString="ccv_server.exe") returned 14
	[0066.693] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0066.694] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0066.694] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0066.696] lstrlenW (lpString="creditservice.exe") returned 17
	[0066.696] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0066.698] lstrlenW (lpString="edcsvr.exe") returned 10
	[0066.698] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0066.699] lstrlenW (lpString="fpos.exe") returned 8
	[0066.699] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0066.701] lstrlenW (lpString="isspos.exe") returned 10
	[0066.701] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0066.702] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0066.703] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0066.704] lstrlenW (lpString="omnipos.exe") returned 11
	[0066.704] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0066.705] lstrlenW (lpString="spcwin.exe") returned 10
	[0066.706] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0066.707] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0066.708] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0066.709] lstrlenW (lpString="utg2.exe") returned 8
	[0066.709] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0066.710] lstrlenW (lpString="interventions.exe") returned 17
	[0066.710] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0066.712] lstrlenW (lpString="hayes.exe") returned 9
	[0066.712] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0066.713] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0066.713] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0066.714] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0066.715] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0066.716] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0066.716] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0066.717] lstrlenW (lpString="taskhost.exe") returned 12
	[0066.717] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0066.718] lstrlenW (lpString="dllhost.exe") returned 11
	[0066.718] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0066.720] lstrlenW (lpString="dllhost.exe") returned 11
	[0066.720] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0066.721] lstrlenW (lpString="000005.exe") returned 10
	[0066.721] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 0
	[0066.723] CloseHandle (hObject=0xe0) returned 1
	[0066.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315268 | out: hHeap=0x2e0000) returned 1
	[0066.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3152b0 | out: hHeap=0x2e0000) returned 1
	[0066.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3152f8 | out: hHeap=0x2e0000) returned 1
	[0066.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315318 | out: hHeap=0x2e0000) returned 1
	[0066.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315360 | out: hHeap=0x2e0000) returned 1
	[0066.724] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x314a00 | out: hHeap=0x2e0000) returned 1
	[0066.725] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4718 | out: hHeap=0x2e0000) returned 1
	[0066.725] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4750 | out: hHeap=0x2e0000) returned 1
	[0066.725] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4348 | out: hHeap=0x2e0000) returned 1
	[0066.725] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4370 | out: hHeap=0x2e0000) returned 1
	[0066.725] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4798 | out: hHeap=0x2e0000) returned 1
	[0066.725] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4398 | out: hHeap=0x2e0000) returned 1
	[0066.726] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x31b428
	[0066.727] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x32b430
	[0066.727] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.728] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4398
	[0066.728] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4398, Size=0x40) returned 0x3169a8
	[0066.728] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.728] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4398
	[0066.728] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.728] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4370
	[0066.729] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.729] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4348
	[0066.729] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4348, Size=0x40) returned 0x3169f0
	[0066.729] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32b430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\000005.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\000005.exe")) returned 0x30
	[0066.729] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33b438
	[0066.730] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34b440
	[0066.731] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.731] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4348
	[0066.731] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4348, Size=0x40) returned 0x316a38
	[0066.731] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a38, Size=0x80) returned 0x315268
	[0066.731] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315268, Size=0x100) returned 0x317bb0
	[0066.731] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0066.732] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bb0 | out: hHeap=0x2e0000) returned 1
	[0066.732] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\000005.exe", lpDst=0x33b438, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\000005.exe") returned 0x1f
	[0066.732] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34b440 | out: hHeap=0x2e0000) returned 1
	[0066.732] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b438 | out: hHeap=0x2e0000) returned 1
	[0066.732] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x20d0020
	[0066.734] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.734] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4348
	[0066.734] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.734] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x315930
	[0066.735] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0066.735] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0066.736] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1
	[0066.736] lstrlenW (lpString="kernel32.dll") returned 12
	[0066.736] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4348 | out: hHeap=0x2e0000) returned 1
	[0066.736] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0066.736] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315930 | out: hHeap=0x2e0000) returned 1
	[0066.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\000005.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\000005.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0
	[0066.737] CreateFileW (lpFileName="C:\\Windows\\System32\\000005.exe" (normalized: "c:\\windows\\system32\\000005.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0066.739] ReadFile (in: hFile=0xe0, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0066.750] WriteFile (in: hFile=0xe4, lpBuffer=0x20d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0066.755] ReadFile (in: hFile=0xe0, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0066.756] CloseHandle (hObject=0xe4) returned 1
	[0066.764] CloseHandle (hObject=0xe0) returned 1
	[0066.764] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.765] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x315930
	[0066.765] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.765] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x3158e0
	[0066.765] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0066.766] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0066.766] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0066.766] lstrlenW (lpString="kernel32.dll") returned 12
	[0066.766] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158e0 | out: hHeap=0x2e0000) returned 1
	[0066.766] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0066.766] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315930 | out: hHeap=0x2e0000) returned 1
	[0066.766] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x20d0020 | out: hHeap=0x2e0000) returned 1
	[0066.768] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.768] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x315930
	[0066.768] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315930, Size=0x40) returned 0x316a38
	[0066.768] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a38, Size=0x80) returned 0x33b450
	[0066.769] lstrlenW (lpString="C:\\Windows\\System32\\000005.exe") returned 30
	[0066.769] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0066.769] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x5c) returned 0x315268
	[0066.770] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0
	[0066.770] RegSetValueExW (in: hKey=0xe0, lpValueName="000005.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\000005.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\000005.exe") returned 0x0
	[0066.772] RegCloseKey (hKey=0xe0) returned 0x0
	[0066.772] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315268 | out: hHeap=0x2e0000) returned 1
	[0066.772] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0066.772] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b450 | out: hHeap=0x2e0000) returned 1
	[0066.772] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33d438
	[0066.772] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34d440
	[0066.773] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00
	[0066.773] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x315930
	[0066.773] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315930, Size=0x40) returned 0x316a38
	[0066.773] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a38, Size=0x80) returned 0x33b450
	[0066.773] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x317bb0
	[0066.773] lstrlenW (lpString="") returned 0
	[0066.773] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0066.774] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8c) returned 0x317cb8
	[0066.774] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0
	[0066.774] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x34d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x34d440*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2
	[0066.774] RegCloseKey (hKey=0xe0) returned 0x0
	[0066.774] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317cb8 | out: hHeap=0x2e0000) returned 1
	[0066.775] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0066.775] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8c) returned 0x317cb8
	[0066.775] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0066.775] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x34d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0
	[0066.776] RegCloseKey (hKey=0xe4) returned 0x0
	[0066.776] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317cb8 | out: hHeap=0x2e0000) returned 1
	[0066.776] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0066.776] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0066.776] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bb0 | out: hHeap=0x2e0000) returned 1
	[0066.776] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000005.exe", lpDst=0x33d438, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000005.exe") returned 0x67
	[0066.776] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d440 | out: hHeap=0x2e0000) returned 1
	[0066.777] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d438 | out: hHeap=0x2e0000) returned 1
	[0066.777] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x20d0020
	[0066.778] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.779] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x315930
	[0066.779] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.779] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x3158e0
	[0066.779] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0066.780] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0066.780] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0066.780] lstrlenW (lpString="kernel32.dll") returned 12
	[0066.780] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315930 | out: hHeap=0x2e0000) returned 1
	[0066.780] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0066.780] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158e0 | out: hHeap=0x2e0000) returned 1
	[0066.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\000005.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\000005.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0066.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000005.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\000005.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0066.785] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0066.793] WriteFile (in: hFile=0xe8, lpBuffer=0x20d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0066.797] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0066.797] CloseHandle (hObject=0xe8) returned 1
	[0066.800] CloseHandle (hObject=0xe4) returned 1
	[0066.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.800] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x3158e0
	[0066.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.801] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x315930
	[0066.801] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0066.802] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0066.802] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0066.802] lstrlenW (lpString="kernel32.dll") returned 12
	[0066.802] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315930 | out: hHeap=0x2e0000) returned 1
	[0066.802] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0066.802] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158e0 | out: hHeap=0x2e0000) returned 1
	[0066.802] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x20d0020 | out: hHeap=0x2e0000) returned 1
	[0066.804] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33d438
	[0066.804] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34d440
	[0066.804] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.804] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x3158e0
	[0066.804] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3158e0, Size=0x40) returned 0x316a38
	[0066.804] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a38, Size=0x80) returned 0x33b450
	[0066.805] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x317bb0
	[0066.805] lstrlenW (lpString="") returned 0
	[0066.805] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0066.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8c) returned 0x317cb8
	[0066.805] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0066.806] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x34d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0
	[0066.806] RegCloseKey (hKey=0xe4) returned 0x0
	[0066.813] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317cb8 | out: hHeap=0x2e0000) returned 1
	[0066.813] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0066.813] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0066.813] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bb0 | out: hHeap=0x2e0000) returned 1
	[0066.813] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000005.exe", lpDst=0x33d438, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000005.exe") returned 0x48
	[0066.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d440 | out: hHeap=0x2e0000) returned 1
	[0066.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d438 | out: hHeap=0x2e0000) returned 1
	[0066.814] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x20d0020
	[0066.817] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.817] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x3158e0
	[0066.817] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.817] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x315930
	[0066.818] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0066.818] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0066.818] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0066.818] lstrlenW (lpString="kernel32.dll") returned 12
	[0066.819] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158e0 | out: hHeap=0x2e0000) returned 1
	[0066.819] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0066.819] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315930 | out: hHeap=0x2e0000) returned 1
	[0066.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\000005.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\000005.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0066.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000005.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\000005.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0066.822] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0066.833] WriteFile (in: hFile=0xe8, lpBuffer=0x20d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0066.855] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0066.855] CloseHandle (hObject=0xe8) returned 1
	[0066.858] CloseHandle (hObject=0xe4) returned 1
	[0066.858] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.858] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x315930
	[0066.859] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.859] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x3158e0
	[0066.859] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0066.860] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0066.860] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0066.860] lstrlenW (lpString="kernel32.dll") returned 12
	[0066.861] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158e0 | out: hHeap=0x2e0000) returned 1
	[0066.861] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0066.861] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315930 | out: hHeap=0x2e0000) returned 1
	[0066.861] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x20d0020 | out: hHeap=0x2e0000) returned 1
	[0066.864] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31b428 | out: hHeap=0x2e0000) returned 1
	[0066.864] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b430 | out: hHeap=0x2e0000) returned 1
	[0066.864] lstrlenW (lpString="%windir%\\System32") returned 17
	[0066.864] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3169a8 | out: hHeap=0x2e0000) returned 1
	[0066.864] lstrlenW (lpString="%appdata%") returned 9
	[0066.865] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4398 | out: hHeap=0x2e0000) returned 1
	[0066.865] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0066.865] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4370 | out: hHeap=0x2e0000) returned 1
	[0066.865] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0066.865] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3169f0 | out: hHeap=0x2e0000) returned 1
	[0066.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.866] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x2f4370
	[0066.866] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4370, Size=0x40) returned 0x3169f0
	[0066.866] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3169f0, Size=0x80) returned 0x33b450
	[0066.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.866] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x2f4370
	[0066.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1fffc) returned 0x31b428
	[0066.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33d438
	[0066.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34d440
	[0066.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0066.867] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x2f4398
	[0066.867] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4398, Size=0x40) returned 0x3169f0
	[0066.868] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3169f0, Size=0x80) returned 0x33b4d8
	[0066.868] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b4d8, Size=0x100) returned 0x317bb0
	[0066.868] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0066.868] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bb0 | out: hHeap=0x2e0000) returned 1
	[0066.868] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x33d438, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c
	[0066.869] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d440 | out: hHeap=0x2e0000) returned 1
	[0066.869] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d438 | out: hHeap=0x2e0000) returned 1
	[0066.869] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1
	[0066.870] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1
	[0066.870] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1
	[0066.871] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1
	[0066.871] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x1c0, dwThreadId=0x5dc)) returned 1
	[0067.383] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0067.383] WriteFile (in: hFile=0xec, lpBuffer=0x33b450*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x33b450*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1
	[0067.383] CloseHandle (hObject=0xfc) returned 1
	[0067.383] CloseHandle (hObject=0xf8) returned 1
	[0067.384] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31b428 | out: hHeap=0x2e0000) returned 1
	[0067.384] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0067.384] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b450 | out: hHeap=0x2e0000) returned 1
	[0067.384] lstrlenW (lpString="%comspec%") returned 9
	[0067.384] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4370 | out: hHeap=0x2e0000) returned 1
	[0067.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0067.385] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314a30
	[0067.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x314a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc
	[0067.387] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f47a8
	[0067.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x2f47a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0067.388] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48
	[0067.388] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x2f4370
	[0067.388] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4370, Size=0x40) returned 0x3169f0
	[0067.389] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0067.389] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xd0) returned 0x317c28
	[0067.389] GetLogicalDrives () returned 0x4
	[0067.389] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10014) returned 0x31b428
	[0067.389] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48
	[0067.390] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x2f4370
	[0067.390] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4370, Size=0x40) returned 0x316a80
	[0067.390] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a80, Size=0x80) returned 0x33b450
	[0067.390] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x319198
	[0067.390] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x319198, Size=0x200) returned 0x319198
	[0067.390] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x319198, Size=0x400) returned 0x319198
	[0067.390] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x319198, Size=0x800) returned 0x3197b0
	[0067.391] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3197b0, Size=0x1000) returned 0x32b448
	[0067.391] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x33d438
	[0067.391] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48
	[0067.391] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314b20
	[0067.391] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4750
	[0067.391] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314b38
	[0067.392] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4760
	[0067.392] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314b50
	[0067.392] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4760, Size=0x8) returned 0x2f4760
	[0067.392] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314b68
	[0067.393] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4760, Size=0x10) returned 0x2f4718
	[0067.393] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314b80
	[0067.393] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314b98
	[0067.393] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4718, Size=0x20) returned 0x317ab0
	[0067.393] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314bb0
	[0067.394] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4760
	[0067.394] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314bc8
	[0067.394] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314be0
	[0067.394] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x317ab0, Size=0x40) returned 0x3152d8
	[0067.394] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314bf8
	[0067.394] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314c10
	[0067.395] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314c28
	[0067.395] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314c40
	[0067.395] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314c58
	[0067.395] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314c70
	[0067.395] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x315320
	[0067.395] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314c88
	[0067.396] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3152d8, Size=0x80) returned 0x319198
	[0067.396] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314ca0
	[0067.396] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314cb8
	[0067.396] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314cd0
	[0067.396] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314ce8
	[0067.396] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3197c8
	[0067.397] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3197e0
	[0067.397] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3197f8
	[0067.397] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4718
	[0067.397] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319810
	[0067.397] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319828
	[0067.397] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319840
	[0067.397] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319858
	[0067.398] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319870
	[0067.398] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319888
	[0067.398] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3198a0
	[0067.398] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3198b8
	[0067.398] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x319198, Size=0x100) returned 0x319198
	[0067.398] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3198d0
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3198e8
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319900
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x319918
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319930
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319948
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4728
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319960
	[0067.399] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319978
	[0067.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319990
	[0067.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x317ab0
	[0067.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199a8
	[0067.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199c0
	[0067.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x317ac0
	[0067.400] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199d8
	[0067.401] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199f0
	[0067.401] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319a08
	[0067.401] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a20
	[0067.401] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a38
	[0067.401] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a50
	[0067.401] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x319a68
	[0067.401] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a80
	[0067.402] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x319a98
	[0067.402] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ab0
	[0067.402] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ac8
	[0067.402] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ae0
	[0067.402] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319af8
	[0067.402] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x317ad0
	[0067.402] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b10
	[0067.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b28
	[0067.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b40
	[0067.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b58
	[0067.403] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x319198, Size=0x200) returned 0x319198
	[0067.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b70
	[0067.403] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x3152d8
	[0067.404] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b88
	[0067.404] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319bc8
	[0067.404] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319be0
	[0067.404] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319bf8
	[0067.404] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c10
	[0067.404] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c28
	[0067.404] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c40
	[0067.405] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c58
	[0067.405] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c70
	[0067.405] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319c88
	[0067.405] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319ca0
	[0067.405] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319cb8
	[0067.405] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319cd0
	[0067.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319ce8
	[0067.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319d00
	[0067.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319d18
	[0067.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319d30
	[0067.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319d48
	[0067.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319d60
	[0067.406] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319d78
	[0067.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319d90
	[0067.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x3152e8
	[0067.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319da8
	[0067.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319dc0
	[0067.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319dd8
	[0067.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x319fc8
	[0067.407] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319df0
	[0067.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319e08
	[0067.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e20
	[0067.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e38
	[0067.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e50
	[0067.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e68
	[0067.408] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e80
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e98
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319eb0
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319ec8
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ee0
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ef8
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f10
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319f28
	[0067.409] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f40
	[0067.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f58
	[0067.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f70
	[0067.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f88
	[0067.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c468
	[0067.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c480
	[0067.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c498
	[0067.410] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x319fd8
	[0067.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x319fe8
	[0067.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c4b0
	[0067.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c4c8
	[0067.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c4e0
	[0067.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c4f8
	[0067.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c510
	[0067.411] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c528
	[0067.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c540
	[0067.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c558
	[0067.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c570
	[0067.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c588
	[0067.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c5a0
	[0067.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c5b8
	[0067.412] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c5d0
	[0067.413] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x319198, Size=0x400) returned 0x319198
	[0067.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c5e8
	[0067.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c600
	[0067.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c618
	[0067.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c630
	[0067.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c648
	[0067.413] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c660
	[0067.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c678
	[0067.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c690
	[0067.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c6a8
	[0067.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c6c0
	[0067.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x319ff8
	[0067.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c6d8
	[0067.414] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c6f0
	[0067.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c708
	[0067.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c720
	[0067.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c738
	[0067.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c750
	[0067.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32c768
	[0067.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c780
	[0067.416] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c798
	[0067.416] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c7b0
	[0067.416] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c7c8
	[0067.416] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c7e0
	[0067.416] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c7f8
	[0067.416] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c810
	[0067.417] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c828
	[0067.417] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a008
	[0067.417] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c868
	[0067.417] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c880
	[0067.417] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c898
	[0067.417] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c8b0
	[0067.418] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c8c8
	[0067.418] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c8e0
	[0067.418] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c8f8
	[0067.418] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c910
	[0067.418] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c928
	[0067.418] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32c940
	[0067.419] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c958
	[0067.419] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32c970
	[0067.419] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c988
	[0067.419] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c9a0
	[0067.419] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c9b8
	[0067.420] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c9d0
	[0067.420] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c9e8
	[0067.420] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32ca00
	[0067.420] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca18
	[0067.420] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca30
	[0067.420] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca48
	[0067.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca60
	[0067.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca78
	[0067.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca90
	[0067.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32caa8
	[0067.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cac0
	[0067.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cad8
	[0067.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32caf0
	[0067.422] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb08
	[0067.422] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb20
	[0067.422] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb38
	[0067.422] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb50
	[0067.422] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb68
	[0067.422] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb80
	[0067.423] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb98
	[0067.423] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32cbb0
	[0067.423] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12) returned 0x315f00
	[0067.423] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cbc8
	[0067.423] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce90
	[0069.088] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cea8
	[0069.088] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cec0
	[0069.088] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ced8
	[0069.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cef0
	[0069.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf08
	[0069.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf20
	[0069.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf38
	[0069.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf50
	[0069.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf68
	[0069.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf80
	[0069.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf98
	[0069.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cfb0
	[0069.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cfc8
	[0069.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cfe0
	[0069.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cff8
	[0069.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d010
	[0069.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d028
	[0069.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d040
	[0069.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d058
	[0069.092] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d070
	[0069.092] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d088
	[0069.092] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32d0a0
	[0069.092] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d0b8
	[0069.092] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a018
	[0069.092] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d0d0
	[0069.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a038
	[0069.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d0e8
	[0069.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d100
	[0069.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d118
	[0069.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d130
	[0069.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d148
	[0069.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d160
	[0069.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d178
	[0069.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d190
	[0069.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d1a8
	[0069.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d1c0
	[0069.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d1d8
	[0069.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d1f0
	[0069.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d208
	[0069.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d220
	[0069.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a048
	[0069.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d238
	[0069.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ea10
	[0069.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ea28
	[0069.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ea40
	[0069.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ea58
	[0069.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ea70
	[0069.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ea88
	[0069.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a058
	[0069.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a068
	[0069.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eaa0
	[0069.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eab8
	[0069.097] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ead0
	[0069.097] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eae8
	[0069.097] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eb00
	[0069.097] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35eb18
	[0069.097] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eb30
	[0069.097] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eb48
	[0069.097] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eb60
	[0069.098] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eb78
	[0069.098] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eb90
	[0069.098] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eba8
	[0069.098] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x319198, Size=0x800) returned 0x35edf8
	[0069.098] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35ebc0
	[0069.098] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ebd8
	[0069.098] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35ebf0
	[0069.099] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35ec08
	[0069.099] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x35ec20
	[0069.099] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ec38
	[0069.099] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ec50
	[0069.099] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ec68
	[0069.099] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ec80
	[0069.100] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ec98
	[0069.100] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ecb0
	[0069.100] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ecc8
	[0069.100] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a078
	[0069.100] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ece0
	[0069.100] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ecf8
	[0069.100] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35ed10
	[0069.101] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ed28
	[0069.101] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ed40
	[0069.101] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ed58
	[0069.101] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ed70
	[0069.101] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35ed88
	[0069.101] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35eda0
	[0069.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35edb8
	[0069.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35edd0
	[0069.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3191b0
	[0069.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3191c8
	[0069.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3191e0
	[0069.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3191f8
	[0069.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12) returned 0x316000
	[0069.103] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319210
	[0069.103] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319228
	[0069.103] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319240
	[0069.103] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319258
	[0069.103] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319270
	[0069.103] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a088
	[0069.103] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319288
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3192a0
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3192b8
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3192d0
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3192e8
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319300
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319318
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319330
	[0069.104] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319348
	[0069.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319360
	[0069.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319378
	[0069.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319390
	[0069.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3193a8
	[0069.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3193c0
	[0069.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3193d8
	[0069.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3193f0
	[0069.106] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319408
	[0069.106] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319420
	[0069.106] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319438
	[0069.106] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319450
	[0069.106] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319468
	[0069.106] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319480
	[0069.106] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319498
	[0069.107] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3194b0
	[0069.107] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3194c8
	[0069.107] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3194e0
	[0069.107] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a098
	[0069.107] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3194f8
	[0069.107] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319510
	[0069.108] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319528
	[0069.108] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319540
	[0069.108] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319558
	[0069.108] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319570
	[0069.108] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f618
	[0069.109] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f630
	[0069.109] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f648
	[0069.109] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f660
	[0069.109] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f678
	[0069.109] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f690
	[0069.109] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f6a8
	[0069.109] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f6c0
	[0069.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f6d8
	[0069.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f6f0
	[0069.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f708
	[0069.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f720
	[0069.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f738
	[0069.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f750
	[0069.110] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f768
	[0069.111] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f780
	[0069.111] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a0a8
	[0069.111] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f798
	[0069.111] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0069.111] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b448 | out: hHeap=0x2e0000) returned 1
	[0069.111] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f7b0
	[0069.112] lstrlenW (lpString="") returned 0
	[0069.112] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35f7b0 | out: hHeap=0x2e0000) returned 1
	[0069.112] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f7b0
	[0069.112] lstrlenW (lpString=".lina") returned 5
	[0069.112] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f7c8
	[0069.112] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4750, Size=0x8) returned 0x2f4750
	[0069.112] lstrlenW (lpString=".lina") returned 5
	[0069.113] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35f7b0 | out: hHeap=0x2e0000) returned 1
	[0069.113] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f7b0
	[0069.113] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a0b8
	[0069.113] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f7e0
	[0069.113] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f7e0, Size=0x20) returned 0x315980
	[0069.113] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315980, Size=0x40) returned 0x316be8
	[0069.114] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316be8, Size=0x80) returned 0x33b450
	[0069.114] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12) returned 0x316020
	[0069.114] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0b8, Size=0x8) returned 0x31a0c8
	[0069.114] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x315980
	[0069.114] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0c8, Size=0x10) returned 0x35f7e0
	[0069.114] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f7f8
	[0069.114] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x315840
	[0069.115] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f7e0, Size=0x20) returned 0x3159f8
	[0069.115] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x35f7e0
	[0069.115] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0069.115] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b450 | out: hHeap=0x2e0000) returned 1
	[0069.115] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f810
	[0069.115] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f810, Size=0x20) returned 0x315a20
	[0069.115] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315a20, Size=0x40) returned 0x316be8
	[0069.116] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0069.116] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x28) returned 0x32d580
	[0069.116] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0069.116] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x316be8 | out: hHeap=0x2e0000) returned 1
	[0069.116] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f810
	[0069.116] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f810, Size=0x20) returned 0x315a20
	[0069.117] lstrlenW (lpString="Info.hta") returned 8
	[0069.117] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12) returned 0x316040
	[0069.117] lstrlenW (lpString="Info.hta") returned 8
	[0069.117] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315a20 | out: hHeap=0x2e0000) returned 1
	[0069.117] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x35fa00
	[0069.187] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35fa00, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\000005.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\000005.exe")) returned 0x30
	[0070.788] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fa00 | out: hHeap=0x2e0000) returned 1
	[0070.788] lstrlenW (lpString="000005.exe") returned 10
	[0070.788] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x316060
	[0070.789] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3159f8, Size=0x40) returned 0x316c78
	[0070.789] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f8d0
	[0070.789] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f8d0, Size=0x20) returned 0x3159f8
	[0070.789] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x35fa00
	[0070.789] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x36fa08
	[0070.790] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f8d0
	[0070.790] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f8d0, Size=0x20) returned 0x315ae8
	[0070.791] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315ae8, Size=0x40) returned 0x316cc0
	[0070.791] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316cc0, Size=0x80) returned 0x33b450
	[0070.791] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x32b448
	[0070.791] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0070.791] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b448 | out: hHeap=0x2e0000) returned 1
	[0070.791] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x35fa00, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0070.792] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36fa08 | out: hHeap=0x2e0000) returned 1
	[0070.792] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fa00 | out: hHeap=0x2e0000) returned 1
	[0070.792] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f8d0
	[0070.792] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a0c8
	[0070.792] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x316080
	[0070.792] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0c8, Size=0x8) returned 0x31a0b8
	[0070.793] lstrlenW (lpString="%windir%;") returned 9
	[0070.793] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3159f8 | out: hHeap=0x2e0000) returned 1
	[0070.793] lstrlenW (lpString="C:\\Windows;") returned 11
	[0070.793] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d438 | out: hHeap=0x2e0000) returned 1
	[0070.793] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x35f8e8
	[0070.794] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f8e8, Size=0x20) returned 0x3159f8
	[0070.794] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3159f8, Size=0x40) returned 0x316cc0
	[0070.794] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316cc0, Size=0x80) returned 0x33b450
	[0070.794] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x32b448
	[0070.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x34) returned 0x35e908
	[0070.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a0c8
	[0070.795] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a0d8
	[0070.795] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a0e8
	[0070.795] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f8e8
	[0070.795] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a0f8
	[0070.795] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f900
	[0070.795] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0f8, Size=0x8) returned 0x31a108
	[0070.796] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f918
	[0070.796] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a108, Size=0x10) returned 0x35f930
	[0070.796] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f948
	[0070.796] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f960
	[0070.796] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f930, Size=0x20) returned 0x3159f8
	[0070.796] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f930
	[0070.796] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f978
	[0070.797] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0c8, Size=0x8) returned 0x31a108
	[0070.797] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0d8, Size=0x8) returned 0x31a0c8
	[0070.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a0d8
	[0070.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x35f990
	[0070.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a0f8
	[0070.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f9a8
	[0070.798] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0f8, Size=0x8) returned 0x31a118
	[0070.798] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f9c0
	[0070.798] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a118, Size=0x10) returned 0x35f9d8
	[0070.798] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b568
	[0070.798] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a118
	[0070.798] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f9d8, Size=0x20) returned 0x315ae8
	[0070.799] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a108, Size=0x10) returned 0x35f9d8
	[0070.799] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0c8, Size=0x10) returned 0x32b580
	[0070.799] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a0c8
	[0070.799] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b598
	[0070.799] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a108
	[0070.799] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b5b0
	[0070.800] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a108, Size=0x8) returned 0x31a0f8
	[0070.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a108
	[0070.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b5c8
	[0070.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a128
	[0070.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b5e0
	[0070.800] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a128, Size=0x8) returned 0x31a138
	[0070.801] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x35f9d8, Size=0x20) returned 0x315b10
	[0070.801] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b580, Size=0x20) returned 0x315b38
	[0070.801] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a128
	[0070.801] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b580
	[0070.801] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a148
	[0070.801] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b5f8
	[0070.802] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a148, Size=0x8) returned 0x31a158
	[0070.802] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x3160a0
	[0070.802] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x3160c0
	[0070.802] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0070.802] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b448 | out: hHeap=0x2e0000) returned 1
	[0070.802] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x80) returned 0x33b450
	[0070.803] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a148
	[0070.803] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b610
	[0070.803] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b610, Size=0x20) returned 0x315b88
	[0070.803] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xd0) returned 0x32b448
	[0070.803] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33d438
	[0070.803] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x33d438, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0070.804] lstrlenW (lpString="C:\\") returned 3
	[0070.804] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0070.804] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d438 | out: hHeap=0x2e0000) returned 1
	[0070.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x28) returned 0x32b520
	[0070.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b610
	[0070.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a168
	[0070.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x14) returned 0x3160e0
	[0070.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b628
	[0070.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x80) returned 0x33b560
	[0070.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b640
	[0070.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x82) returned 0x35e948
	[0070.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b658
	[0070.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a178
	[0070.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b670
	[0070.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x80) returned 0x33b5e8
	[0070.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b688
	[0070.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x2) returned 0x31a188
	[0070.807] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a198
	[0070.807] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b6a0
	[0070.807] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x80) returned 0x33b670
	[0070.807] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b6b8
	[0070.807] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a1a8
	[0070.807] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a188, Size=0x82) returned 0x32b950
	[0070.808] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a1a8, Size=0x100) returned 0x32b9e0
	[0070.808] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b6d0
	[0070.808] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x82) returned 0x32bae8
	[0070.808] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b6e8
	[0070.808] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x82) returned 0x32bb78
	[0070.808] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b950, Size=0x104) returned 0x32bc08
	[0070.809] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b9e0, Size=0x200) returned 0x32bd18
	[0070.810] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a198 | out: hHeap=0x2e0000) returned 1
	[0070.810] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bd18 | out: hHeap=0x2e0000) returned 1
	[0070.811] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b6b8 | out: hHeap=0x2e0000) returned 1
	[0070.811] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5e8 | out: hHeap=0x2e0000) returned 1
	[0070.811] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b670 | out: hHeap=0x2e0000) returned 1
	[0070.811] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b670 | out: hHeap=0x2e0000) returned 1
	[0070.811] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b6a0 | out: hHeap=0x2e0000) returned 1
	[0070.811] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bc08 | out: hHeap=0x2e0000) returned 1
	[0070.811] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b688 | out: hHeap=0x2e0000) returned 1
	[0070.812] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bae8 | out: hHeap=0x2e0000) returned 1
	[0070.812] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b6d0 | out: hHeap=0x2e0000) returned 1
	[0070.812] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bb78 | out: hHeap=0x2e0000) returned 1
	[0070.812] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b6e8 | out: hHeap=0x2e0000) returned 1
	[0070.812] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a198
	[0070.812] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b6e8
	[0070.812] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b6e8, Size=0x20) returned 0x315bb0
	[0070.813] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315bb0, Size=0x40) returned 0x316cc0
	[0070.813] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b6e8
	[0070.813] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a168 | out: hHeap=0x2e0000) returned 1
	[0070.813] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b610 | out: hHeap=0x2e0000) returned 1
	[0070.813] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35e948 | out: hHeap=0x2e0000) returned 1
	[0070.813] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b640 | out: hHeap=0x2e0000) returned 1
	[0070.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b560 | out: hHeap=0x2e0000) returned 1
	[0070.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b628 | out: hHeap=0x2e0000) returned 1
	[0070.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a178 | out: hHeap=0x2e0000) returned 1
	[0070.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b658 | out: hHeap=0x2e0000) returned 1
	[0070.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b520 | out: hHeap=0x2e0000) returned 1
	[0070.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3160e0 | out: hHeap=0x2e0000) returned 1
	[0070.814] lstrlenW (lpString="%systemdrive%") returned 13
	[0070.815] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315b88 | out: hHeap=0x2e0000) returned 1
	[0070.815] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b450 | out: hHeap=0x2e0000) returned 1
	[0070.815] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a148 | out: hHeap=0x2e0000) returned 1
	[0070.815] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x2c) returned 0x35e948
	[0070.815] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x2000) returned 0x32e7b0
	[0070.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x31b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110
	[0070.817] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10014) returned 0x35fa00
	[0070.817] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b658
	[0070.817] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b658, Size=0x20) returned 0x315bb0
	[0070.817] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315bb0, Size=0x40) returned 0x316d08
	[0070.818] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316d08, Size=0x80) returned 0x33b450
	[0070.818] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x32b950
	[0070.818] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b950, Size=0x200) returned 0x32b950
	[0070.818] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b950, Size=0x400) returned 0x32b950
	[0070.818] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b950, Size=0x800) returned 0x32b950
	[0070.819] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b950, Size=0x1000) returned 0x3307b8
	[0070.819] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x33d438
	[0070.819] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32b658
	[0070.819] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b628
	[0070.819] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a148
	[0070.819] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b640
	[0070.820] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a178
	[0070.820] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b610
	[0070.820] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a148, Size=0x8) returned 0x31a168
	[0070.820] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b6d0
	[0070.820] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a168, Size=0x10) returned 0x32b688
	[0070.820] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b6a0
	[0070.821] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b670
	[0070.821] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32b688, Size=0x20) returned 0x315bb0
	[0070.821] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b688
	[0070.821] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a168
	[0070.821] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32b6b8
	[0070.821] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32b700
	[0070.822] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315bb0, Size=0x40) returned 0x316d08
	[0070.822] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32b718
	[0070.822] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32b730
	[0070.822] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32b748
	[0070.822] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32b760
	[0070.822] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b778
	[0070.822] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b790
	[0070.823] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a148
	[0070.823] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b7a8
	[0070.823] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316d08, Size=0x80) returned 0x33b450
	[0070.823] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b7c0
	[0070.823] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b7d8
	[0070.823] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b7f0
	[0070.824] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b808
	[0070.824] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b820
	[0070.824] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b838
	[0070.824] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b850
	[0070.824] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a1a8
	[0070.841] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b868
	[0070.841] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b880
	[0070.841] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b898
	[0070.842] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b8b0
	[0070.842] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b8c8
	[0070.842] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b8e0
	[0070.842] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32b8f8
	[0070.842] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b910
	[0070.842] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x3317d8
	[0070.843] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32b928
	[0070.843] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x35f9d8
	[0070.843] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bb90
	[0070.843] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32bba8
	[0070.843] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bbc0
	[0070.843] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bbd8
	[0070.843] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a188
	[0070.844] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bbf0
	[0070.844] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bc08
	[0070.844] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bc20
	[0070.846] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a1b8
	[0070.847] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bc38
	[0070.847] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bc50
	[0070.847] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a1c8
	[0070.847] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bc68
	[0070.847] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bc80
	[0070.847] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32bc98
	[0070.848] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bcb0
	[0070.848] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bcc8
	[0070.848] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bce0
	[0070.848] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32bcf8
	[0070.848] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bd10
	[0070.848] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32bd28
	[0070.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bd40
	[0070.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bd58
	[0070.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bd70
	[0070.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bd88
	[0070.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a1d8
	[0070.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bda0
	[0070.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bdb8
	[0070.850] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bdd0
	[0070.850] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bde8
	[0070.850] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3317d8, Size=0x200) returned 0x32bf78
	[0070.850] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32be00
	[0070.850] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a1e8
	[0070.850] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32be18
	[0070.851] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32be30
	[0070.851] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32be48
	[0070.851] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32be60
	[0070.851] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32be78
	[0070.851] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32be90
	[0070.851] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bea8
	[0070.852] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bec0
	[0070.852] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bed8
	[0070.852] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32bef0
	[0070.852] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32bf08
	[0070.852] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bf20
	[0070.852] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32bf38
	[0070.853] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32bf50
	[0070.853] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3337d8
	[0070.853] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3337f0
	[0070.853] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333808
	[0070.853] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333820
	[0070.853] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333838
	[0070.854] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333850
	[0070.854] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333868
	[0070.854] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a1f8
	[0070.854] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333880
	[0070.854] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333898
	[0070.855] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3338b0
	[0070.855] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a208
	[0070.855] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3338c8
	[0070.855] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3338e0
	[0070.855] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3338f8
	[0070.855] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333910
	[0070.862] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333928
	[0070.862] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333940
	[0070.863] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333958
	[0070.863] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333970
	[0070.863] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333988
	[0070.863] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3339a0
	[0070.863] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3339b8
	[0070.863] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3339d0
	[0070.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3339e8
	[0070.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333a00
	[0070.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333a18
	[0070.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333a30
	[0070.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333a48
	[0070.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333a60
	[0070.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333a78
	[0070.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333a90
	[0070.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333aa8
	[0070.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a218
	[0070.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a228
	[0070.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333ac0
	[0070.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333ad8
	[0070.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333af0
	[0070.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333b08
	[0070.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333b20
	[0070.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333b38
	[0070.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333b50
	[0070.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333b68
	[0070.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333b80
	[0070.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333b98
	[0070.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333bd8
	[0070.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333bf0
	[0070.867] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333c08
	[0070.867] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32bf78, Size=0x400) returned 0x32bf78
	[0070.868] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333c20
	[0070.868] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333c38
	[0070.868] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333c50
	[0070.868] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333c68
	[0070.868] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333c80
	[0070.868] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333c98
	[0070.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333cb0
	[0070.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333cc8
	[0070.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333ce0
	[0070.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333cf8
	[0070.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a238
	[0070.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333d10
	[0070.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x333d28
	[0070.870] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333d40
	[0070.870] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333d58
	[0070.870] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333d70
	[0070.870] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333d88
	[0070.870] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x333da0
	[0070.870] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333db8
	[0070.870] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333dd0
	[0070.871] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333de8
	[0070.871] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333e00
	[0070.871] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333e18
	[0070.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333e30
	[0070.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333e48
	[0070.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333e60
	[0070.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a248
	[0070.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333e78
	[0070.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333e90
	[0070.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333ea8
	[0070.873] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333ec0
	[0070.873] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333ed8
	[0070.873] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333ef0
	[0070.873] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333f08
	[0070.873] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333f20
	[0070.873] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333f38
	[0070.874] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x333f50
	[0070.874] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x333f68
	[0070.875] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32bf78, Size=0x800) returned 0x3347c0
	[0070.875] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3357a8, Size=0x20) returned 0x315bb0
	[0070.875] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315bb0, Size=0x40) returned 0x316d08
	[0070.876] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316d08, Size=0x80) returned 0x33b450
	[0070.876] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a2e8, Size=0x8) returned 0x31a2f8
	[0070.876] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a2f8, Size=0x10) returned 0x3357a8
	[0070.876] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3357a8, Size=0x20) returned 0x315c00
	[0070.876] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3307e8, Size=0x20) returned 0x315c28
	[0070.877] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315c28, Size=0x40) returned 0x316d08
	[0070.877] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0070.877] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3307e8, Size=0x20) returned 0x315c28
	[0070.877] lstrlenW (lpString="Info.hta") returned 8
	[0070.877] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36fa20, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\000005.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\000005.exe")) returned 0x30
	[0071.622] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36fa20 | out: hHeap=0x2e0000) returned 1
	[0071.622] lstrlenW (lpString="000005.exe") returned 10
	[0071.622] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315c00, Size=0x40) returned 0x316d08
	[0071.622] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330830, Size=0x20) returned 0x315c00
	[0071.623] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330830, Size=0x20) returned 0x315ca0
	[0071.624] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315ca0, Size=0x40) returned 0x316d50
	[0071.624] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316d50, Size=0x80) returned 0x33b450
	[0071.624] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x3317d8
	[0071.624] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0071.624] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3317d8 | out: hHeap=0x2e0000) returned 1
	[0071.624] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x36fa20, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0071.624] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x37fa28 | out: hHeap=0x2e0000) returned 1
	[0071.625] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36fa20 | out: hHeap=0x2e0000) returned 1
	[0071.625] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a2e8, Size=0x8) returned 0x31a2f8
	[0071.625] lstrlenW (lpString="%windir%;") returned 9
	[0071.625] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315c00 | out: hHeap=0x2e0000) returned 1
	[0071.625] lstrlenW (lpString="C:\\Windows;") returned 11
	[0071.625] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d438 | out: hHeap=0x2e0000) returned 1
	[0071.629] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330848, Size=0x20) returned 0x315c00
	[0071.629] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315c00, Size=0x40) returned 0x316d50
	[0071.629] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316d50, Size=0x80) returned 0x33b450
	[0071.630] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x3317d8
	[0071.630] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a328, Size=0x8) returned 0x31a338
	[0071.630] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a338, Size=0x10) returned 0x3308a8
	[0071.630] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3308a8, Size=0x20) returned 0x315c00
	[0071.630] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a2e8, Size=0x8) returned 0x31a338
	[0071.630] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a308, Size=0x8) returned 0x31a2e8
	[0071.631] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a328, Size=0x8) returned 0x31a348
	[0071.631] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a348, Size=0x10) returned 0x330950
	[0071.631] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330950, Size=0x20) returned 0x315ca0
	[0071.631] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a338, Size=0x10) returned 0x330950
	[0071.631] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a2e8, Size=0x10) returned 0x330980
	[0071.631] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a338, Size=0x8) returned 0x31a328
	[0071.632] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a358, Size=0x8) returned 0x31a368
	[0071.632] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330950, Size=0x20) returned 0x315c28
	[0071.632] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330980, Size=0x20) returned 0x315d18
	[0071.632] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a378, Size=0x8) returned 0x31a388
	[0071.632] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3309f8, Size=0x20) returned 0x315d68
	[0071.633] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x33d438, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0071.633] lstrlenW (lpString="C:\\") returned 3
	[0071.633] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0071.633] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d438 | out: hHeap=0x2e0000) returned 1
	[0071.634] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330fe0, Size=0x82) returned 0x32c180
	[0071.634] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x331000, Size=0x100) returned 0x3317d8
	[0071.634] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32c180, Size=0x104) returned 0x32c330
	[0071.635] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3317d8, Size=0x200) returned 0x3357e0
	[0071.636] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330ff0 | out: hHeap=0x2e0000) returned 1
	[0071.637] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3357e0 | out: hHeap=0x2e0000) returned 1
	[0071.637] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330aa0 | out: hHeap=0x2e0000) returned 1
	[0071.637] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b670 | out: hHeap=0x2e0000) returned 1
	[0071.637] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330a58 | out: hHeap=0x2e0000) returned 1
	[0071.637] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5e8 | out: hHeap=0x2e0000) returned 1
	[0071.637] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330a88 | out: hHeap=0x2e0000) returned 1
	[0071.637] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32c330 | out: hHeap=0x2e0000) returned 1
	[0071.638] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330a70 | out: hHeap=0x2e0000) returned 1
	[0071.638] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32c210 | out: hHeap=0x2e0000) returned 1
	[0071.638] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330ab8 | out: hHeap=0x2e0000) returned 1
	[0071.638] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32c2a0 | out: hHeap=0x2e0000) returned 1
	[0071.638] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330ad0 | out: hHeap=0x2e0000) returned 1
	[0071.638] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330ad0, Size=0x20) returned 0x3397e0
	[0071.638] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3397e0, Size=0x40) returned 0x316d50
	[0071.644] WaitForMultipleObjects (nCount=0x2, lpHandles=0x317c28*=0x110, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0x208


Thread:
	id = 4
	os_tid = 0x7e8

	[0069.030] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32cbe0
	[0069.030] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32cbe0, Size=0x20) returned 0x2f4370
	[0069.031] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4370, Size=0x40) returned 0x316a80
	[0069.031] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a80, Size=0x80) returned 0x33b450
	[0069.031] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x32ce60
	[0069.031] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32cbe0
	[0069.031] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32cbe0, Size=0x20) returned 0x2f4370
	[0069.032] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4370, Size=0x40) returned 0x316a80
	[0069.032] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a80, Size=0x80) returned 0x33b450
	[0069.032] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b450, Size=0x100) returned 0x32cf68
	[0069.032] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32cbe0
	[0069.032] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a018
	[0069.033] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32cbf8
	[0069.033] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a018, Size=0x8) returned 0x31a028
	[0069.033] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x315f20
	[0069.033] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a028, Size=0x10) returned 0x32cc10
	[0069.033] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x315f40
	[0069.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x2f4370
	[0069.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32cc10, Size=0x20) returned 0x2f4398
	[0069.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1c) returned 0x2f4348
	[0069.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x315f60
	[0069.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x315930
	[0069.035] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32cc10
	[0069.035] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a028
	[0069.035] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40) returned 0x316a80
	[0069.035] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a028, Size=0x8) returned 0x31a018
	[0069.035] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x3c) returned 0x316ac8
	[0069.036] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a018, Size=0x10) returned 0x32cc28
	[0069.036] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x315f80
	[0069.036] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x315fa0
	[0069.036] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32cc28, Size=0x20) returned 0x3158e0
	[0069.036] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x317e98
	[0069.036] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0069.037] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32ce60 | out: hHeap=0x2e0000) returned 1
	[0069.037] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0069.037] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32cf68 | out: hHeap=0x2e0000) returned 1
	[0069.037] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x315980
	[0069.038] EnumServicesStatusExW (in: hSCManager=0x315980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0069.039] GetLastError () returned 0xea
	[0069.039] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x11e4) returned 0x32e7d0
	[0069.040] EnumServicesStatusExW (in: hSCManager=0x315980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7d0, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7d0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0069.041] CloseServiceHandle (hSCObject=0x315980) returned 1
	[0069.042] lstrlenW (lpString="Appinfo") returned 7
	[0069.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0069.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0069.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0069.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0069.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0069.043] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0069.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0069.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0069.044] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0069.044] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0069.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0069.044] lstrlenW (lpString="AudioSrv") returned 8
	[0069.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0069.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0069.045] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0069.045] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0069.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0069.045] lstrlenW (lpString="BFE") returned 3
	[0069.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0069.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0069.046] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0069.046] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0069.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0069.047] lstrlenW (lpString="CryptSvc") returned 8
	[0069.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0069.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0069.047] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0069.047] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0069.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0069.048] lstrlenW (lpString="CscService") returned 10
	[0069.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0069.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0069.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0069.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0069.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0069.049] lstrlenW (lpString="DcomLaunch") returned 10
	[0069.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0069.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0069.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0069.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0069.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0069.050] lstrlenW (lpString="Dhcp") returned 4
	[0069.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0069.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0069.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0069.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0069.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0069.051] lstrlenW (lpString="Dnscache") returned 8
	[0069.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0069.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0069.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0069.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0069.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0069.052] lstrlenW (lpString="DPS") returned 3
	[0069.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0069.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0069.053] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0069.053] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0069.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0069.053] lstrlenW (lpString="eventlog") returned 8
	[0069.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0069.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0069.054] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0069.054] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0069.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0069.054] lstrlenW (lpString="EventSystem") returned 11
	[0069.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0069.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0069.055] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0069.055] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0069.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0069.055] lstrlenW (lpString="gpsvc") returned 5
	[0069.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0069.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0069.056] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0069.056] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0069.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0069.056] lstrlenW (lpString="iphlpsvc") returned 8
	[0069.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0069.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0069.057] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0069.057] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0069.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0069.057] lstrlenW (lpString="LanmanServer") returned 12
	[0069.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0069.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0069.058] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0069.058] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0069.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0069.058] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0069.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0069.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0069.059] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0069.059] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0069.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0069.060] lstrlenW (lpString="lmhosts") returned 7
	[0069.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0069.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0069.060] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0069.060] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0069.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0069.061] lstrlenW (lpString="MMCSS") returned 5
	[0069.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0069.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0069.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0069.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0069.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0069.138] lstrlenW (lpString="MpsSvc") returned 6
	[0069.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0069.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0069.139] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0069.139] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0069.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0069.139] lstrlenW (lpString="Netman") returned 6
	[0069.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0069.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0069.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0069.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0069.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0069.141] lstrlenW (lpString="netprofm") returned 8
	[0069.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0069.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0069.141] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0069.141] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0069.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0069.142] lstrlenW (lpString="NlaSvc") returned 6
	[0069.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0069.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0069.142] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0069.142] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0069.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0069.143] lstrlenW (lpString="nsi") returned 3
	[0069.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0069.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0069.143] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0069.143] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0069.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0069.144] lstrlenW (lpString="PcaSvc") returned 6
	[0069.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0069.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0069.144] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0069.144] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0069.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0069.145] lstrlenW (lpString="PlugPlay") returned 8
	[0069.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0069.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0069.145] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0069.146] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0069.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0069.146] lstrlenW (lpString="Power") returned 5
	[0069.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0069.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0069.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0069.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0069.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0069.147] lstrlenW (lpString="ProfSvc") returned 7
	[0069.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0069.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0069.148] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0069.148] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0069.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0069.148] lstrlenW (lpString="RpcEptMapper") returned 12
	[0069.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0069.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0069.149] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0069.149] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0069.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0069.149] lstrlenW (lpString="RpcSs") returned 5
	[0069.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0069.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0069.150] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0069.150] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0069.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0069.150] lstrlenW (lpString="SamSs") returned 5
	[0069.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0069.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0069.151] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0069.151] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0069.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0069.151] lstrlenW (lpString="Schedule") returned 8
	[0069.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0069.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0069.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0069.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0069.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0069.152] lstrlenW (lpString="SENS") returned 4
	[0069.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0069.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0069.153] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0069.153] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0069.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0069.153] lstrlenW (lpString="ShellHWDetection") returned 16
	[0069.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0069.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0069.154] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0069.154] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0069.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0069.155] lstrlenW (lpString="Spooler") returned 7
	[0069.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0069.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0069.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0069.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0069.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0069.156] lstrlenW (lpString="SysMain") returned 7
	[0069.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0069.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0069.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0069.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0069.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0069.157] lstrlenW (lpString="Themes") returned 6
	[0069.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0069.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0069.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0069.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0069.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0069.158] lstrlenW (lpString="TrkWks") returned 6
	[0069.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0069.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0069.158] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0069.158] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0069.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0069.159] lstrlenW (lpString="UxSms") returned 5
	[0069.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0069.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0069.159] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0069.160] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0069.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0069.160] lstrlenW (lpString="WdiServiceHost") returned 14
	[0069.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0069.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0069.160] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0069.161] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0069.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0069.161] lstrlenW (lpString="WdiSystemHost") returned 13
	[0069.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0069.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0069.161] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0069.162] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0069.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0069.162] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0069.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0069.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0069.162] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0069.162] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0069.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0069.163] lstrlenW (lpString="Winmgmt") returned 7
	[0069.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0069.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0069.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0069.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0069.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0069.164] lstrlenW (lpString="WPDBusEnum") returned 10
	[0069.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0069.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0069.164] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0069.164] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0069.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0069.165] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7d0 | out: hHeap=0x2e0000) returned 1
	[0069.167] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x110
	[0069.173] Process32FirstW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0069.173] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0069.174] lstrlenW (lpString="System") returned 6
	[0069.174] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0069.174] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0069.174] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0069.175] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0069.175] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0069.175] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0069.175] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0069.175] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0069.176] lstrlenW (lpString="smss.exe") returned 8
	[0069.176] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0069.176] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0069.177] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0069.177] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0069.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0069.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0069.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0069.177] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0069.178] lstrlenW (lpString="csrss.exe") returned 9
	[0069.178] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0069.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0069.179] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0069.179] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0069.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0069.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0069.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0069.179] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0069.180] lstrlenW (lpString="wininit.exe") returned 11
	[0069.180] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0069.180] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0069.181] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0069.181] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0069.181] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0069.181] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0069.181] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0069.181] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0069.182] lstrlenW (lpString="csrss.exe") returned 9
	[0069.182] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0069.182] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0069.183] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0069.183] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0069.183] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0069.183] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0069.184] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0069.185] lstrlenW (lpString="winlogon.exe") returned 12
	[0069.185] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0069.186] lstrlenW (lpString="services.exe") returned 12
	[0069.186] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0069.204] lstrlenW (lpString="lsass.exe") returned 9
	[0069.205] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0069.205] lstrlenW (lpString="lsm.exe") returned 7
	[0069.206] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.206] lstrlenW (lpString="svchost.exe") returned 11
	[0069.207] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.207] lstrlenW (lpString="svchost.exe") returned 11
	[0069.208] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.208] lstrlenW (lpString="svchost.exe") returned 11
	[0069.208] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.209] lstrlenW (lpString="svchost.exe") returned 11
	[0069.209] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.210] lstrlenW (lpString="svchost.exe") returned 11
	[0069.210] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0069.211] lstrlenW (lpString="audiodg.exe") returned 11
	[0069.211] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.212] lstrlenW (lpString="svchost.exe") returned 11
	[0069.212] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.213] lstrlenW (lpString="svchost.exe") returned 11
	[0069.213] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0069.214] lstrlenW (lpString="dwm.exe") returned 7
	[0069.214] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0069.215] lstrlenW (lpString="explorer.exe") returned 12
	[0069.215] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0069.216] lstrlenW (lpString="spoolsv.exe") returned 11
	[0069.216] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.217] lstrlenW (lpString="svchost.exe") returned 11
	[0069.217] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0069.218] lstrlenW (lpString="taskhost.exe") returned 12
	[0069.219] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0069.219] lstrlenW (lpString="taskeng.exe") returned 11
	[0069.220] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0069.220] lstrlenW (lpString="elliott grace.exe") returned 17
	[0069.221] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0069.221] lstrlenW (lpString="floyd.exe") returned 9
	[0069.222] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0069.222] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0069.223] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0069.223] lstrlenW (lpString="bond.exe") returned 8
	[0069.224] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0069.224] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0069.225] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0069.226] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0069.226] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0069.227] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0069.227] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0069.228] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0069.228] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0069.229] lstrlenW (lpString="wheel_year.exe") returned 14
	[0069.229] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0069.230] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0069.230] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0069.231] lstrlenW (lpString="alifilm.exe") returned 11
	[0069.231] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0069.232] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0069.232] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0069.233] lstrlenW (lpString="orchestra.exe") returned 13
	[0069.233] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0069.234] lstrlenW (lpString="decade.exe") returned 10
	[0069.234] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0069.234] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0069.235] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0069.235] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0069.236] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0069.236] lstrlenW (lpString="bracket das.exe") returned 15
	[0069.236] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0069.237] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0069.237] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0069.238] lstrlenW (lpString="3dftp.exe") returned 9
	[0069.238] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0069.239] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0069.239] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0069.240] lstrlenW (lpString="alftp.exe") returned 9
	[0069.240] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0069.241] lstrlenW (lpString="barca.exe") returned 9
	[0069.241] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0069.242] lstrlenW (lpString="bitkinex.exe") returned 12
	[0069.242] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0069.243] lstrlenW (lpString="coreftp.exe") returned 11
	[0069.243] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0069.244] lstrlenW (lpString="far.exe") returned 7
	[0069.244] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0069.245] lstrlenW (lpString="filezilla.exe") returned 13
	[0069.245] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0069.246] lstrlenW (lpString="flashfxp.exe") returned 12
	[0069.246] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0069.247] lstrlenW (lpString="fling.exe") returned 9
	[0069.247] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0069.248] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0069.248] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0069.251] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0069.251] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0069.252] lstrlenW (lpString="icq.exe") returned 7
	[0069.252] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0069.253] lstrlenW (lpString="leechftp.exe") returned 12
	[0069.253] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0069.253] lstrlenW (lpString="ncftp.exe") returned 9
	[0069.254] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0069.254] lstrlenW (lpString="notepad.exe") returned 11
	[0069.255] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0069.256] lstrlenW (lpString="operamail.exe") returned 13
	[0069.256] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0069.257] lstrlenW (lpString="pidgin.exe") returned 10
	[0069.257] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0069.258] lstrlenW (lpString="scriptftp.exe") returned 13
	[0069.258] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0069.259] lstrlenW (lpString="skype.exe") returned 9
	[0069.259] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0069.260] lstrlenW (lpString="smartftp.exe") returned 12
	[0069.260] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0069.261] lstrlenW (lpString="thunderbird.exe") returned 15
	[0069.261] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0069.261] lstrlenW (lpString="totalcmd.exe") returned 12
	[0069.262] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0069.263] lstrlenW (lpString="trillian.exe") returned 12
	[0069.263] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0069.264] lstrlenW (lpString="webdrive.exe") returned 12
	[0069.264] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0069.265] lstrlenW (lpString="whatsapp.exe") returned 12
	[0069.265] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0069.266] lstrlenW (lpString="winscp.exe") returned 10
	[0069.266] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0069.267] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0069.267] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0069.268] lstrlenW (lpString="active-charge.exe") returned 17
	[0069.268] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0069.269] lstrlenW (lpString="accupos.exe") returned 11
	[0069.269] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0069.270] lstrlenW (lpString="afr38.exe") returned 9
	[0069.270] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0069.271] lstrlenW (lpString="aldelo.exe") returned 10
	[0069.271] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0069.272] lstrlenW (lpString="ccv_server.exe") returned 14
	[0069.272] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0069.273] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0069.273] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0069.274] lstrlenW (lpString="creditservice.exe") returned 17
	[0069.274] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0069.275] lstrlenW (lpString="edcsvr.exe") returned 10
	[0069.275] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0069.276] lstrlenW (lpString="fpos.exe") returned 8
	[0069.276] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0069.277] lstrlenW (lpString="isspos.exe") returned 10
	[0069.277] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0069.278] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0069.278] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0069.279] lstrlenW (lpString="omnipos.exe") returned 11
	[0069.279] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0069.280] lstrlenW (lpString="spcwin.exe") returned 10
	[0069.280] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0069.281] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0069.281] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0069.282] lstrlenW (lpString="utg2.exe") returned 8
	[0069.282] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0069.283] lstrlenW (lpString="interventions.exe") returned 17
	[0069.283] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0069.284] lstrlenW (lpString="hayes.exe") returned 9
	[0069.284] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0069.285] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0069.286] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0069.286] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0069.287] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0069.288] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0069.288] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0069.289] lstrlenW (lpString="taskhost.exe") returned 12
	[0069.289] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0069.290] lstrlenW (lpString="dllhost.exe") returned 11
	[0069.290] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0069.291] lstrlenW (lpString="dllhost.exe") returned 11
	[0069.291] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0069.292] lstrlenW (lpString="000005.exe") returned 10
	[0069.292] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0069.293] lstrlenW (lpString="cmd.exe") returned 7
	[0069.293] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0069.294] lstrlenW (lpString="conhost.exe") returned 11
	[0069.294] Process32NextW (in: hSnapshot=0x110, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0069.295] CloseHandle (hObject=0x110) returned 1
	[0069.295] Sleep (dwMilliseconds=0x1f4) 
	[0070.919] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x315ca0
	[0070.920] EnumServicesStatusExW (in: hSCManager=0x315ca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0070.921] GetLastError () returned 0xea
	[0070.921] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x11e4) returned 0x37fa28
	[0070.921] EnumServicesStatusExW (in: hSCManager=0x315ca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37fa28, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37fa28, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0070.922] CloseServiceHandle (hSCObject=0x315ca0) returned 1
	[0070.923] lstrlenW (lpString="Appinfo") returned 7
	[0070.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0070.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0070.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0070.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0070.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0070.924] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0070.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0070.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0070.924] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0070.924] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0070.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0070.924] lstrlenW (lpString="AudioSrv") returned 8
	[0070.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0070.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0070.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0070.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0070.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0070.925] lstrlenW (lpString="BFE") returned 3
	[0070.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0070.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0070.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0070.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0070.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0070.926] lstrlenW (lpString="CryptSvc") returned 8
	[0070.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0070.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0070.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0070.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0070.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0070.927] lstrlenW (lpString="CscService") returned 10
	[0070.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0070.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0070.928] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0070.928] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0070.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0070.928] lstrlenW (lpString="DcomLaunch") returned 10
	[0070.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0070.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0070.929] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0070.929] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0070.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0070.929] lstrlenW (lpString="Dhcp") returned 4
	[0070.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0070.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0070.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0070.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0070.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0070.930] lstrlenW (lpString="Dnscache") returned 8
	[0070.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0070.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0070.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0070.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0070.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0070.931] lstrlenW (lpString="DPS") returned 3
	[0070.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0070.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0070.931] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0070.931] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0070.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0070.932] lstrlenW (lpString="eventlog") returned 8
	[0070.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0070.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0070.932] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0070.932] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0070.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0070.933] lstrlenW (lpString="EventSystem") returned 11
	[0070.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0070.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0070.933] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0070.933] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0070.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0070.933] lstrlenW (lpString="gpsvc") returned 5
	[0070.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0070.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0070.942] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0070.942] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0070.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0070.942] lstrlenW (lpString="iphlpsvc") returned 8
	[0070.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0070.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0070.943] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0070.943] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0070.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0070.943] lstrlenW (lpString="LanmanServer") returned 12
	[0070.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0070.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0070.944] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0070.944] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0070.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0070.944] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0070.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0070.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0070.944] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0070.944] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0070.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0070.945] lstrlenW (lpString="lmhosts") returned 7
	[0070.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0070.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0070.945] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0070.945] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0070.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0070.945] lstrlenW (lpString="MMCSS") returned 5
	[0070.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0070.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0070.946] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0070.946] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0070.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0070.946] lstrlenW (lpString="MpsSvc") returned 6
	[0070.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0070.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0070.947] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0070.947] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0070.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0070.947] lstrlenW (lpString="Netman") returned 6
	[0070.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0070.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0070.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0070.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0070.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0070.948] lstrlenW (lpString="netprofm") returned 8
	[0070.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0070.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0070.948] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0070.949] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0070.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0070.950] lstrlenW (lpString="NlaSvc") returned 6
	[0070.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0070.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0070.950] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0070.950] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0070.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0070.950] lstrlenW (lpString="nsi") returned 3
	[0070.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0070.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0070.951] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0070.951] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0070.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0070.951] lstrlenW (lpString="PcaSvc") returned 6
	[0070.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0070.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0070.952] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0070.952] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0070.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0070.952] lstrlenW (lpString="PlugPlay") returned 8
	[0070.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0070.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0070.953] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0070.953] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0070.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0070.953] lstrlenW (lpString="Power") returned 5
	[0070.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0070.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0070.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0070.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0070.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0070.954] lstrlenW (lpString="ProfSvc") returned 7
	[0070.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0070.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0070.954] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0070.955] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0070.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0070.955] lstrlenW (lpString="RpcEptMapper") returned 12
	[0070.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0070.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0070.955] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0070.956] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0070.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0070.956] lstrlenW (lpString="RpcSs") returned 5
	[0070.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0070.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0070.956] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0070.956] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0070.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0070.957] lstrlenW (lpString="SamSs") returned 5
	[0070.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0070.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0070.957] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0070.957] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0070.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0070.958] lstrlenW (lpString="Schedule") returned 8
	[0070.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0070.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0070.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0070.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0070.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0070.958] lstrlenW (lpString="SENS") returned 4
	[0070.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0070.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0070.959] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0070.959] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0070.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0070.959] lstrlenW (lpString="ShellHWDetection") returned 16
	[0070.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0070.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0070.960] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0070.960] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0070.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0070.960] lstrlenW (lpString="Spooler") returned 7
	[0070.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0070.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0070.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0070.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0070.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0070.961] lstrlenW (lpString="SysMain") returned 7
	[0070.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0070.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0070.961] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0070.961] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0070.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0070.962] lstrlenW (lpString="Themes") returned 6
	[0070.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0070.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0070.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0070.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0070.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0070.962] lstrlenW (lpString="TrkWks") returned 6
	[0070.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0070.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0070.963] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0070.963] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0070.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0070.963] lstrlenW (lpString="UxSms") returned 5
	[0070.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0070.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0070.964] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0070.964] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0070.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0070.964] lstrlenW (lpString="WdiServiceHost") returned 14
	[0070.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0070.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0070.965] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0071.047] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0071.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0071.048] lstrlenW (lpString="WdiSystemHost") returned 13
	[0071.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0071.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0071.048] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0071.048] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0071.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0071.048] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0071.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0071.049] lstrlenW (lpString="Winmgmt") returned 7
	[0071.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0071.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0071.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0071.050] lstrlenW (lpString="WPDBusEnum") returned 10
	[0071.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0071.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0071.050] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0071.050] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0071.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0071.051] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x37fa28 | out: hHeap=0x2e0000) returned 1
	[0071.051] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x120
	[0071.282] Process32FirstW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0071.283] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0071.284] lstrlenW (lpString="System") returned 6
	[0071.284] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0071.284] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0071.284] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0071.284] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0071.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0071.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0071.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0071.285] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0071.286] lstrlenW (lpString="smss.exe") returned 8
	[0071.286] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0071.286] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0071.286] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0071.286] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0071.286] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0071.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0071.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0071.287] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.288] lstrlenW (lpString="csrss.exe") returned 9
	[0071.288] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0071.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0071.288] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0071.288] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0071.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0071.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0071.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0071.289] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0071.290] lstrlenW (lpString="wininit.exe") returned 11
	[0071.290] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0071.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0071.290] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0071.290] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0071.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0071.291] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0071.291] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0071.291] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.291] lstrlenW (lpString="csrss.exe") returned 9
	[0071.292] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0071.292] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0071.292] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0071.292] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0071.292] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0071.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0071.293] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0071.294] lstrlenW (lpString="winlogon.exe") returned 12
	[0071.294] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0071.295] lstrlenW (lpString="services.exe") returned 12
	[0071.295] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0071.295] lstrlenW (lpString="lsass.exe") returned 9
	[0071.296] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0071.296] lstrlenW (lpString="lsm.exe") returned 7
	[0071.296] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.297] lstrlenW (lpString="svchost.exe") returned 11
	[0071.297] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.298] lstrlenW (lpString="svchost.exe") returned 11
	[0071.298] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.298] lstrlenW (lpString="svchost.exe") returned 11
	[0071.299] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.299] lstrlenW (lpString="svchost.exe") returned 11
	[0071.300] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.300] lstrlenW (lpString="svchost.exe") returned 11
	[0071.300] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0071.301] lstrlenW (lpString="audiodg.exe") returned 11
	[0071.301] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.302] lstrlenW (lpString="svchost.exe") returned 11
	[0071.302] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.303] lstrlenW (lpString="svchost.exe") returned 11
	[0071.303] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0071.303] lstrlenW (lpString="dwm.exe") returned 7
	[0071.304] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0071.304] lstrlenW (lpString="explorer.exe") returned 12
	[0071.304] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0071.305] lstrlenW (lpString="spoolsv.exe") returned 11
	[0071.305] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.306] lstrlenW (lpString="svchost.exe") returned 11
	[0071.306] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0071.307] lstrlenW (lpString="taskhost.exe") returned 12
	[0071.307] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0071.308] lstrlenW (lpString="taskeng.exe") returned 11
	[0071.309] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0071.309] lstrlenW (lpString="elliott grace.exe") returned 17
	[0071.309] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0071.310] lstrlenW (lpString="floyd.exe") returned 9
	[0071.310] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0071.311] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0071.311] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0071.312] lstrlenW (lpString="bond.exe") returned 8
	[0071.312] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0071.313] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0071.313] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0071.313] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0071.314] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0071.314] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0071.314] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0071.315] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0071.315] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0071.316] lstrlenW (lpString="wheel_year.exe") returned 14
	[0071.316] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0071.317] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0071.317] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0071.317] lstrlenW (lpString="alifilm.exe") returned 11
	[0071.318] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0071.318] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0071.318] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0071.319] lstrlenW (lpString="orchestra.exe") returned 13
	[0071.319] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0071.320] lstrlenW (lpString="decade.exe") returned 10
	[0071.320] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0071.321] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0071.321] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0071.322] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0071.322] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0071.322] lstrlenW (lpString="bracket das.exe") returned 15
	[0071.323] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0071.323] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0071.334] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0071.335] lstrlenW (lpString="3dftp.exe") returned 9
	[0071.335] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0071.335] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0071.336] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0071.336] lstrlenW (lpString="alftp.exe") returned 9
	[0071.336] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0071.337] lstrlenW (lpString="barca.exe") returned 9
	[0071.337] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0071.338] lstrlenW (lpString="bitkinex.exe") returned 12
	[0071.338] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0071.339] lstrlenW (lpString="coreftp.exe") returned 11
	[0071.339] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0071.340] lstrlenW (lpString="far.exe") returned 7
	[0071.340] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0071.340] lstrlenW (lpString="filezilla.exe") returned 13
	[0071.341] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0071.341] lstrlenW (lpString="flashfxp.exe") returned 12
	[0071.341] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0071.342] lstrlenW (lpString="fling.exe") returned 9
	[0071.342] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0071.342] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0071.342] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0071.343] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0071.343] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0071.344] lstrlenW (lpString="icq.exe") returned 7
	[0071.344] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0071.344] lstrlenW (lpString="leechftp.exe") returned 12
	[0071.344] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0071.345] lstrlenW (lpString="ncftp.exe") returned 9
	[0071.345] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0071.346] lstrlenW (lpString="notepad.exe") returned 11
	[0071.346] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0071.346] lstrlenW (lpString="operamail.exe") returned 13
	[0071.347] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0071.347] lstrlenW (lpString="pidgin.exe") returned 10
	[0071.347] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0071.348] lstrlenW (lpString="scriptftp.exe") returned 13
	[0071.348] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0071.349] lstrlenW (lpString="skype.exe") returned 9
	[0071.349] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0071.350] lstrlenW (lpString="smartftp.exe") returned 12
	[0071.350] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0071.351] lstrlenW (lpString="thunderbird.exe") returned 15
	[0071.351] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0071.352] lstrlenW (lpString="totalcmd.exe") returned 12
	[0071.352] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0071.352] lstrlenW (lpString="trillian.exe") returned 12
	[0071.353] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0071.353] lstrlenW (lpString="webdrive.exe") returned 12
	[0071.353] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0071.354] lstrlenW (lpString="whatsapp.exe") returned 12
	[0071.354] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0071.356] lstrlenW (lpString="winscp.exe") returned 10
	[0071.356] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0071.357] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0071.357] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0071.358] lstrlenW (lpString="active-charge.exe") returned 17
	[0071.358] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0071.359] lstrlenW (lpString="accupos.exe") returned 11
	[0071.359] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0071.360] lstrlenW (lpString="afr38.exe") returned 9
	[0071.360] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0071.361] lstrlenW (lpString="aldelo.exe") returned 10
	[0071.361] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0071.362] lstrlenW (lpString="ccv_server.exe") returned 14
	[0071.362] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0071.363] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0071.363] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0071.364] lstrlenW (lpString="creditservice.exe") returned 17
	[0071.364] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0071.365] lstrlenW (lpString="edcsvr.exe") returned 10
	[0071.365] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0071.366] lstrlenW (lpString="fpos.exe") returned 8
	[0071.366] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0071.366] lstrlenW (lpString="isspos.exe") returned 10
	[0071.367] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0071.367] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0071.368] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0071.368] lstrlenW (lpString="omnipos.exe") returned 11
	[0071.368] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0071.369] lstrlenW (lpString="spcwin.exe") returned 10
	[0071.369] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0071.370] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0071.606] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0071.606] lstrlenW (lpString="utg2.exe") returned 8
	[0071.607] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0071.607] lstrlenW (lpString="interventions.exe") returned 17
	[0071.608] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0071.608] lstrlenW (lpString="hayes.exe") returned 9
	[0071.609] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0071.609] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0071.610] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0071.610] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0071.611] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0071.611] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0071.612] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0071.612] lstrlenW (lpString="taskhost.exe") returned 12
	[0071.613] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0071.613] lstrlenW (lpString="dllhost.exe") returned 11
	[0071.614] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0071.614] lstrlenW (lpString="dllhost.exe") returned 11
	[0071.615] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0071.615] lstrlenW (lpString="000005.exe") returned 10
	[0071.616] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0071.616] lstrlenW (lpString="cmd.exe") returned 7
	[0071.617] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.617] lstrlenW (lpString="conhost.exe") returned 11
	[0071.618] Process32NextW (in: hSnapshot=0x120, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0071.618] CloseHandle (hObject=0x120) returned 1
	[0071.619] Sleep (dwMilliseconds=0x1f4) 
	[0072.749] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339ab0
	[0072.886] EnumServicesStatusExW (in: hSCManager=0x339ab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0072.887] GetLastError () returned 0xea
	[0072.887] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x11e4) returned 0x3d2e88
	[0072.887] EnumServicesStatusExW (in: hSCManager=0x339ab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d2e88, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d2e88, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0072.889] CloseServiceHandle (hSCObject=0x339ab0) returned 1
	[0072.890] lstrlenW (lpString="Appinfo") returned 7
	[0072.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0072.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0072.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0072.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0072.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0072.891] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0072.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0072.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0072.891] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0072.892] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0072.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0072.892] lstrlenW (lpString="AudioSrv") returned 8
	[0072.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0072.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0072.893] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0072.893] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0072.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0072.893] lstrlenW (lpString="BFE") returned 3
	[0072.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0072.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0072.894] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0072.894] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0072.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0072.894] lstrlenW (lpString="CryptSvc") returned 8
	[0072.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0072.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0072.895] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0072.895] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0072.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0072.895] lstrlenW (lpString="CscService") returned 10
	[0072.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0072.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0072.896] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0072.896] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0072.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0072.896] lstrlenW (lpString="DcomLaunch") returned 10
	[0072.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0072.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0072.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0072.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0072.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0072.897] lstrlenW (lpString="Dhcp") returned 4
	[0072.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0072.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0072.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0072.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0072.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0072.898] lstrlenW (lpString="Dnscache") returned 8
	[0072.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0072.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0072.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0072.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0072.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0072.900] lstrlenW (lpString="DPS") returned 3
	[0072.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0072.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0072.900] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0072.900] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0072.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0072.901] lstrlenW (lpString="eventlog") returned 8
	[0072.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0072.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0072.901] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0072.901] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0072.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0072.902] lstrlenW (lpString="EventSystem") returned 11
	[0072.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0072.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0072.902] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0072.902] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0072.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0072.903] lstrlenW (lpString="gpsvc") returned 5
	[0072.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0072.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0072.903] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0072.903] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0072.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0072.904] lstrlenW (lpString="iphlpsvc") returned 8
	[0072.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0072.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0072.904] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0072.904] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0072.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0072.905] lstrlenW (lpString="LanmanServer") returned 12
	[0072.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0072.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0072.905] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0072.905] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0072.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0072.906] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0072.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0072.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0072.906] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0072.906] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0072.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0072.907] lstrlenW (lpString="lmhosts") returned 7
	[0072.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0072.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0072.907] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0072.908] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0072.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0072.908] lstrlenW (lpString="MMCSS") returned 5
	[0072.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0072.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0072.908] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0072.908] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0072.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0072.911] lstrlenW (lpString="MpsSvc") returned 6
	[0072.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0072.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0072.912] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0072.912] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0072.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0072.912] lstrlenW (lpString="Netman") returned 6
	[0072.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0072.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0072.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0072.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0072.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0072.913] lstrlenW (lpString="netprofm") returned 8
	[0072.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0072.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0072.914] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0072.914] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0072.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0072.914] lstrlenW (lpString="NlaSvc") returned 6
	[0072.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0072.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0072.914] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0072.915] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0072.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0072.916] lstrlenW (lpString="nsi") returned 3
	[0072.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0072.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0072.917] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0072.917] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0072.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0072.917] lstrlenW (lpString="PcaSvc") returned 6
	[0072.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0072.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0072.918] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0072.918] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0072.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0072.918] lstrlenW (lpString="PlugPlay") returned 8
	[0072.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0072.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0072.918] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0072.919] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0072.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0072.919] lstrlenW (lpString="Power") returned 5
	[0072.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0072.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0072.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0072.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0072.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0072.920] lstrlenW (lpString="ProfSvc") returned 7
	[0072.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0072.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0072.920] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0072.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0072.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0072.921] lstrlenW (lpString="RpcEptMapper") returned 12
	[0072.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0072.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0072.921] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0072.922] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0072.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0072.922] lstrlenW (lpString="RpcSs") returned 5
	[0072.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0072.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0072.923] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0072.923] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0072.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0072.923] lstrlenW (lpString="SamSs") returned 5
	[0072.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0072.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0072.924] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0072.924] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0072.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0072.924] lstrlenW (lpString="Schedule") returned 8
	[0072.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0072.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0072.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0072.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0072.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0072.925] lstrlenW (lpString="SENS") returned 4
	[0072.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0072.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0072.926] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0072.926] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0072.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0072.926] lstrlenW (lpString="ShellHWDetection") returned 16
	[0072.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0072.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0072.927] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0072.927] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0072.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0072.927] lstrlenW (lpString="Spooler") returned 7
	[0072.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0072.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0072.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0072.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0072.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0072.928] lstrlenW (lpString="SysMain") returned 7
	[0072.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0072.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0072.929] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0072.929] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0072.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0072.929] lstrlenW (lpString="Themes") returned 6
	[0072.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0072.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0072.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0072.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0072.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0073.307] lstrlenW (lpString="TrkWks") returned 6
	[0073.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0073.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0073.307] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0073.308] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0073.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0073.308] lstrlenW (lpString="UxSms") returned 5
	[0073.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0073.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0073.309] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0073.309] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0073.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0073.309] lstrlenW (lpString="WdiServiceHost") returned 14
	[0073.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0073.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0073.310] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0073.310] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0073.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0073.310] lstrlenW (lpString="WdiSystemHost") returned 13
	[0073.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0073.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0073.310] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0073.311] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0073.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0073.311] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0073.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0073.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0073.311] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0073.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0073.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0073.312] lstrlenW (lpString="Winmgmt") returned 7
	[0073.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0073.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0073.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0073.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0073.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0073.313] lstrlenW (lpString="WPDBusEnum") returned 10
	[0073.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0073.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0073.313] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0073.313] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0073.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0073.314] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3d2e88 | out: hHeap=0x2e0000) returned 1
	[0073.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c
	[0073.391] Process32FirstW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0073.391] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0073.392] lstrlenW (lpString="System") returned 6
	[0073.392] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0073.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0073.393] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0073.393] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0073.393] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0073.393] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0073.393] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0073.394] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0073.394] lstrlenW (lpString="smss.exe") returned 8
	[0073.395] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0073.395] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0073.395] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0073.395] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0073.395] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0073.395] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0073.396] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0073.396] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0073.396] lstrlenW (lpString="csrss.exe") returned 9
	[0073.397] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0073.397] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0073.397] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0073.397] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0073.397] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0073.397] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0073.398] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0073.398] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0073.399] lstrlenW (lpString="wininit.exe") returned 11
	[0073.399] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0073.399] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0073.399] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0073.400] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0073.400] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0073.400] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0073.400] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0073.400] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0073.401] lstrlenW (lpString="csrss.exe") returned 9
	[0073.401] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0073.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0073.402] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0073.402] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0073.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0073.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0073.402] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0073.403] lstrlenW (lpString="winlogon.exe") returned 12
	[0073.403] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0073.404] lstrlenW (lpString="services.exe") returned 12
	[0073.404] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0073.405] lstrlenW (lpString="lsass.exe") returned 9
	[0073.405] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0073.406] lstrlenW (lpString="lsm.exe") returned 7
	[0073.406] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.407] lstrlenW (lpString="svchost.exe") returned 11
	[0073.407] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.408] lstrlenW (lpString="svchost.exe") returned 11
	[0073.408] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.409] lstrlenW (lpString="svchost.exe") returned 11
	[0073.409] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.410] lstrlenW (lpString="svchost.exe") returned 11
	[0073.410] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.410] lstrlenW (lpString="svchost.exe") returned 11
	[0073.411] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0073.411] lstrlenW (lpString="audiodg.exe") returned 11
	[0073.412] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.412] lstrlenW (lpString="svchost.exe") returned 11
	[0073.412] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.413] lstrlenW (lpString="svchost.exe") returned 11
	[0073.413] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0073.414] lstrlenW (lpString="dwm.exe") returned 7
	[0073.414] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0073.415] lstrlenW (lpString="explorer.exe") returned 12
	[0073.415] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0073.416] lstrlenW (lpString="spoolsv.exe") returned 11
	[0073.416] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.417] lstrlenW (lpString="svchost.exe") returned 11
	[0073.417] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0073.418] lstrlenW (lpString="taskhost.exe") returned 12
	[0073.418] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0073.418] lstrlenW (lpString="taskeng.exe") returned 11
	[0073.419] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0073.419] lstrlenW (lpString="elliott grace.exe") returned 17
	[0073.419] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0073.420] lstrlenW (lpString="floyd.exe") returned 9
	[0073.420] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0073.421] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0073.421] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0073.422] lstrlenW (lpString="bond.exe") returned 8
	[0073.422] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0073.423] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0073.423] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0073.424] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0073.424] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0073.425] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0073.425] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0073.425] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0073.426] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0073.426] lstrlenW (lpString="wheel_year.exe") returned 14
	[0073.427] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0073.427] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0073.428] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0073.428] lstrlenW (lpString="alifilm.exe") returned 11
	[0073.428] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0073.429] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0073.482] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0073.483] lstrlenW (lpString="orchestra.exe") returned 13
	[0073.483] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0073.484] lstrlenW (lpString="decade.exe") returned 10
	[0073.484] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0073.485] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0073.485] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0073.486] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0073.486] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0073.487] lstrlenW (lpString="bracket das.exe") returned 15
	[0073.487] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0073.488] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0073.488] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0073.489] lstrlenW (lpString="3dftp.exe") returned 9
	[0073.489] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0073.489] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0073.490] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0073.490] lstrlenW (lpString="alftp.exe") returned 9
	[0073.491] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0073.491] lstrlenW (lpString="barca.exe") returned 9
	[0073.491] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0073.492] lstrlenW (lpString="bitkinex.exe") returned 12
	[0073.492] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0073.493] lstrlenW (lpString="coreftp.exe") returned 11
	[0073.493] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0073.494] lstrlenW (lpString="far.exe") returned 7
	[0073.494] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0073.495] lstrlenW (lpString="filezilla.exe") returned 13
	[0073.495] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0073.496] lstrlenW (lpString="flashfxp.exe") returned 12
	[0073.496] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0073.497] lstrlenW (lpString="fling.exe") returned 9
	[0073.497] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0073.497] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0073.498] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0073.498] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0073.498] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0073.499] lstrlenW (lpString="icq.exe") returned 7
	[0073.499] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0073.500] lstrlenW (lpString="leechftp.exe") returned 12
	[0073.500] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0073.501] lstrlenW (lpString="ncftp.exe") returned 9
	[0073.501] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0073.501] lstrlenW (lpString="notepad.exe") returned 11
	[0073.502] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0073.502] lstrlenW (lpString="operamail.exe") returned 13
	[0073.503] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0073.503] lstrlenW (lpString="pidgin.exe") returned 10
	[0073.504] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0073.504] lstrlenW (lpString="scriptftp.exe") returned 13
	[0073.504] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0073.505] lstrlenW (lpString="skype.exe") returned 9
	[0073.505] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0073.506] lstrlenW (lpString="smartftp.exe") returned 12
	[0073.506] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0073.507] lstrlenW (lpString="thunderbird.exe") returned 15
	[0073.507] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0073.509] lstrlenW (lpString="totalcmd.exe") returned 12
	[0073.509] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0073.509] lstrlenW (lpString="trillian.exe") returned 12
	[0073.510] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0073.510] lstrlenW (lpString="webdrive.exe") returned 12
	[0073.510] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0073.511] lstrlenW (lpString="whatsapp.exe") returned 12
	[0073.511] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0073.512] lstrlenW (lpString="winscp.exe") returned 10
	[0073.512] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0073.513] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0073.513] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0073.514] lstrlenW (lpString="active-charge.exe") returned 17
	[0073.514] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0073.515] lstrlenW (lpString="accupos.exe") returned 11
	[0073.515] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0073.516] lstrlenW (lpString="afr38.exe") returned 9
	[0073.516] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0073.517] lstrlenW (lpString="aldelo.exe") returned 10
	[0073.517] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0073.517] lstrlenW (lpString="ccv_server.exe") returned 14
	[0073.518] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0073.518] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0073.518] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0073.519] lstrlenW (lpString="creditservice.exe") returned 17
	[0073.519] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0073.520] lstrlenW (lpString="edcsvr.exe") returned 10
	[0073.520] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0073.521] lstrlenW (lpString="fpos.exe") returned 8
	[0073.521] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0073.521] lstrlenW (lpString="isspos.exe") returned 10
	[0073.522] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0073.522] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0073.522] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0074.802] lstrlenW (lpString="omnipos.exe") returned 11
	[0074.803] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0074.804] lstrlenW (lpString="spcwin.exe") returned 10
	[0074.804] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0074.805] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0074.806] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0074.807] lstrlenW (lpString="utg2.exe") returned 8
	[0074.807] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0074.808] lstrlenW (lpString="interventions.exe") returned 17
	[0074.808] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0074.809] lstrlenW (lpString="hayes.exe") returned 9
	[0074.809] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0074.810] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0074.810] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0074.811] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0074.811] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0074.812] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0074.812] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0074.813] lstrlenW (lpString="taskhost.exe") returned 12
	[0074.813] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0074.814] lstrlenW (lpString="dllhost.exe") returned 11
	[0074.814] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0074.815] lstrlenW (lpString="dllhost.exe") returned 11
	[0074.815] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0074.816] lstrlenW (lpString="000005.exe") returned 10
	[0074.817] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0074.817] lstrlenW (lpString="cmd.exe") returned 7
	[0074.818] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0074.819] lstrlenW (lpString="conhost.exe") returned 11
	[0074.819] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0074.820] lstrlenW (lpString="vssadmin.exe") returned 12
	[0074.820] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0074.821] CloseHandle (hObject=0x17c) returned 1
	[0074.822] Sleep (dwMilliseconds=0x1f4) 
	[0075.601] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339bf0
	[0075.602] EnumServicesStatusExW (in: hSCManager=0x339bf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0075.603] GetLastError () returned 0xea
	[0075.603] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x11e4) returned 0x36b6548
	[0075.603] EnumServicesStatusExW (in: hSCManager=0x339bf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b6548, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b6548, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0075.604] CloseServiceHandle (hSCObject=0x339bf0) returned 1
	[0075.605] lstrlenW (lpString="Appinfo") returned 7
	[0075.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0075.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0075.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0075.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0075.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0075.606] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0075.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0075.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0075.606] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0075.607] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0075.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0075.607] lstrlenW (lpString="AudioSrv") returned 8
	[0075.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0075.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0075.608] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0075.608] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0075.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0075.608] lstrlenW (lpString="BFE") returned 3
	[0075.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0075.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0075.609] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0075.609] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0075.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0075.609] lstrlenW (lpString="CryptSvc") returned 8
	[0075.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0075.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0075.610] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0075.610] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0075.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0075.610] lstrlenW (lpString="CscService") returned 10
	[0075.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0075.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0075.611] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0075.611] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0075.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0075.611] lstrlenW (lpString="DcomLaunch") returned 10
	[0075.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0075.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0075.612] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0075.612] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0075.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0075.612] lstrlenW (lpString="Dhcp") returned 4
	[0075.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0075.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0075.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0075.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0075.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0075.613] lstrlenW (lpString="Dnscache") returned 8
	[0075.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0075.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0075.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0075.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0075.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0075.615] lstrlenW (lpString="DPS") returned 3
	[0075.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0075.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0075.615] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0075.615] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0075.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0075.616] lstrlenW (lpString="eventlog") returned 8
	[0075.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0075.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0075.616] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0075.616] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0075.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0075.617] lstrlenW (lpString="EventSystem") returned 11
	[0075.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0075.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0075.617] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0075.617] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0075.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0075.618] lstrlenW (lpString="gpsvc") returned 5
	[0075.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0075.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0075.618] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0075.618] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0075.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0075.619] lstrlenW (lpString="iphlpsvc") returned 8
	[0075.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0075.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0075.619] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0075.620] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0075.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0075.620] lstrlenW (lpString="LanmanServer") returned 12
	[0075.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0075.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0075.620] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0075.621] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0075.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0075.621] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0075.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0075.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0075.621] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0075.622] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0075.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0075.622] lstrlenW (lpString="lmhosts") returned 7
	[0075.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0075.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0075.623] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0075.623] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0075.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0075.623] lstrlenW (lpString="MMCSS") returned 5
	[0075.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0075.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0075.624] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0075.624] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0075.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0075.624] lstrlenW (lpString="MpsSvc") returned 6
	[0075.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0075.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0075.625] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0075.625] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0075.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0075.625] lstrlenW (lpString="Netman") returned 6
	[0075.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0075.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0075.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0075.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0075.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0075.626] lstrlenW (lpString="netprofm") returned 8
	[0075.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0075.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0075.626] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0075.627] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0075.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0075.627] lstrlenW (lpString="NlaSvc") returned 6
	[0075.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0075.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0075.627] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0075.627] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0075.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0075.627] lstrlenW (lpString="nsi") returned 3
	[0075.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0075.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0075.628] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0075.628] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0075.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0075.628] lstrlenW (lpString="PcaSvc") returned 6
	[0075.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0075.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0075.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0075.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0075.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0075.630] lstrlenW (lpString="PlugPlay") returned 8
	[0075.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0075.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0075.630] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0075.630] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0075.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0075.631] lstrlenW (lpString="Power") returned 5
	[0075.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0075.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0075.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0075.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0075.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0075.632] lstrlenW (lpString="ProfSvc") returned 7
	[0075.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0075.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0075.632] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0075.632] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0075.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0075.633] lstrlenW (lpString="RpcEptMapper") returned 12
	[0075.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0075.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0075.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0075.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0075.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0075.634] lstrlenW (lpString="RpcSs") returned 5
	[0075.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0075.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0075.634] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0075.634] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0075.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0075.635] lstrlenW (lpString="SamSs") returned 5
	[0075.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0075.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0075.635] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0075.635] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0075.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0075.636] lstrlenW (lpString="Schedule") returned 8
	[0075.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0075.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0075.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0075.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0075.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0075.636] lstrlenW (lpString="SENS") returned 4
	[0075.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0075.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0075.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0075.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0075.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0075.637] lstrlenW (lpString="ShellHWDetection") returned 16
	[0075.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0075.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0075.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0075.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0075.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0075.638] lstrlenW (lpString="Spooler") returned 7
	[0075.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0075.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0075.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0075.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0075.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0075.639] lstrlenW (lpString="SysMain") returned 7
	[0075.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0075.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0075.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0075.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0075.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0075.640] lstrlenW (lpString="Themes") returned 6
	[0075.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0075.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0075.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0075.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0075.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0075.641] lstrlenW (lpString="TrkWks") returned 6
	[0075.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0075.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0075.641] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0075.641] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0075.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0075.641] lstrlenW (lpString="UxSms") returned 5
	[0075.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0075.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0075.642] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0075.642] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0075.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0075.642] lstrlenW (lpString="WdiServiceHost") returned 14
	[0075.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0075.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0075.642] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0075.643] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0075.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0075.643] lstrlenW (lpString="WdiSystemHost") returned 13
	[0075.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0075.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0075.643] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0075.643] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0075.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0075.644] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0075.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0075.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0075.644] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0075.644] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0075.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0075.645] lstrlenW (lpString="Winmgmt") returned 7
	[0075.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0075.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0075.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0075.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0075.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0075.646] lstrlenW (lpString="WPDBusEnum") returned 10
	[0075.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0075.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0075.646] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0075.646] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0075.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0075.647] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36b6548 | out: hHeap=0x2e0000) returned 1
	[0075.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c
	[0075.734] Process32FirstW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0075.735] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0075.736] lstrlenW (lpString="System") returned 6
	[0075.736] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0075.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0075.736] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0075.736] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0075.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0075.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0075.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0075.737] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0075.738] lstrlenW (lpString="smss.exe") returned 8
	[0075.738] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0075.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0075.738] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0075.739] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0075.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0075.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0075.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0075.739] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0075.740] lstrlenW (lpString="csrss.exe") returned 9
	[0075.740] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0075.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0075.741] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0075.741] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0075.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0075.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0075.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0075.742] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0075.742] lstrlenW (lpString="wininit.exe") returned 11
	[0075.743] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0075.743] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0075.743] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0075.743] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0075.743] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0075.743] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0075.743] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0075.744] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0075.744] lstrlenW (lpString="csrss.exe") returned 9
	[0075.745] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0075.745] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0075.745] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0075.745] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0075.745] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0075.745] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0075.746] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0075.746] lstrlenW (lpString="winlogon.exe") returned 12
	[0075.747] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0075.747] lstrlenW (lpString="services.exe") returned 12
	[0075.748] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0075.748] lstrlenW (lpString="lsass.exe") returned 9
	[0075.748] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0075.749] lstrlenW (lpString="lsm.exe") returned 7
	[0075.749] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.750] lstrlenW (lpString="svchost.exe") returned 11
	[0075.750] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.751] lstrlenW (lpString="svchost.exe") returned 11
	[0075.751] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.752] lstrlenW (lpString="svchost.exe") returned 11
	[0075.752] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.753] lstrlenW (lpString="svchost.exe") returned 11
	[0075.753] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.754] lstrlenW (lpString="svchost.exe") returned 11
	[0075.754] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0075.755] lstrlenW (lpString="audiodg.exe") returned 11
	[0075.755] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.756] lstrlenW (lpString="svchost.exe") returned 11
	[0075.756] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.757] lstrlenW (lpString="svchost.exe") returned 11
	[0075.757] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0075.758] lstrlenW (lpString="dwm.exe") returned 7
	[0075.758] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0075.759] lstrlenW (lpString="explorer.exe") returned 12
	[0075.759] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0075.760] lstrlenW (lpString="spoolsv.exe") returned 11
	[0075.760] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0075.761] lstrlenW (lpString="svchost.exe") returned 11
	[0075.761] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0075.761] lstrlenW (lpString="taskhost.exe") returned 12
	[0075.762] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0075.762] lstrlenW (lpString="taskeng.exe") returned 11
	[0075.763] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0075.763] lstrlenW (lpString="elliott grace.exe") returned 17
	[0075.763] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0075.764] lstrlenW (lpString="floyd.exe") returned 9
	[0075.764] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0075.765] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0075.765] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0075.766] lstrlenW (lpString="bond.exe") returned 8
	[0075.766] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0075.766] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0075.767] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0075.767] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0075.767] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0075.768] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0075.768] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0075.769] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0075.769] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0075.928] lstrlenW (lpString="wheel_year.exe") returned 14
	[0075.928] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0075.929] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0075.929] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0075.930] lstrlenW (lpString="alifilm.exe") returned 11
	[0075.930] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0075.931] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0075.931] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0075.932] lstrlenW (lpString="orchestra.exe") returned 13
	[0075.932] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0075.932] lstrlenW (lpString="decade.exe") returned 10
	[0075.933] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0075.933] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0075.934] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0075.934] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0075.934] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0075.935] lstrlenW (lpString="bracket das.exe") returned 15
	[0075.935] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0075.936] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0075.936] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0075.936] lstrlenW (lpString="3dftp.exe") returned 9
	[0075.937] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0075.937] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0075.937] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0075.938] lstrlenW (lpString="alftp.exe") returned 9
	[0075.938] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0075.939] lstrlenW (lpString="barca.exe") returned 9
	[0075.939] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0075.939] lstrlenW (lpString="bitkinex.exe") returned 12
	[0075.940] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0075.940] lstrlenW (lpString="coreftp.exe") returned 11
	[0075.940] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0075.941] lstrlenW (lpString="far.exe") returned 7
	[0075.941] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0075.942] lstrlenW (lpString="filezilla.exe") returned 13
	[0075.942] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0075.943] lstrlenW (lpString="flashfxp.exe") returned 12
	[0075.943] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0075.944] lstrlenW (lpString="fling.exe") returned 9
	[0075.944] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0075.945] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0075.945] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0075.946] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0075.946] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0075.947] lstrlenW (lpString="icq.exe") returned 7
	[0075.947] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0075.948] lstrlenW (lpString="leechftp.exe") returned 12
	[0075.948] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0075.949] lstrlenW (lpString="ncftp.exe") returned 9
	[0075.949] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0075.950] lstrlenW (lpString="notepad.exe") returned 11
	[0075.950] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0075.951] lstrlenW (lpString="operamail.exe") returned 13
	[0075.951] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0075.952] lstrlenW (lpString="pidgin.exe") returned 10
	[0075.952] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0075.953] lstrlenW (lpString="scriptftp.exe") returned 13
	[0075.954] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0075.955] lstrlenW (lpString="skype.exe") returned 9
	[0075.955] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0075.956] lstrlenW (lpString="smartftp.exe") returned 12
	[0075.956] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0075.957] lstrlenW (lpString="thunderbird.exe") returned 15
	[0075.958] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0075.959] lstrlenW (lpString="totalcmd.exe") returned 12
	[0075.959] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0075.960] lstrlenW (lpString="trillian.exe") returned 12
	[0075.960] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0075.961] lstrlenW (lpString="webdrive.exe") returned 12
	[0075.961] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0075.962] lstrlenW (lpString="whatsapp.exe") returned 12
	[0075.962] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0075.963] lstrlenW (lpString="winscp.exe") returned 10
	[0075.963] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0075.964] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0075.965] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0075.965] lstrlenW (lpString="active-charge.exe") returned 17
	[0075.966] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0075.966] lstrlenW (lpString="accupos.exe") returned 11
	[0075.967] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0075.968] lstrlenW (lpString="afr38.exe") returned 9
	[0075.968] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0075.969] lstrlenW (lpString="aldelo.exe") returned 10
	[0075.969] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0075.970] lstrlenW (lpString="ccv_server.exe") returned 14
	[0075.970] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0075.971] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0075.971] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0075.972] lstrlenW (lpString="creditservice.exe") returned 17
	[0075.972] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0075.973] lstrlenW (lpString="edcsvr.exe") returned 10
	[0075.973] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0076.111] lstrlenW (lpString="fpos.exe") returned 8
	[0076.345] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0076.346] lstrlenW (lpString="isspos.exe") returned 10
	[0076.346] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0076.347] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0076.348] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0076.348] lstrlenW (lpString="omnipos.exe") returned 11
	[0076.349] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0076.349] lstrlenW (lpString="spcwin.exe") returned 10
	[0076.349] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0076.350] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0076.350] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0076.351] lstrlenW (lpString="utg2.exe") returned 8
	[0076.351] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0076.352] lstrlenW (lpString="interventions.exe") returned 17
	[0076.352] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0076.353] lstrlenW (lpString="hayes.exe") returned 9
	[0076.353] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0076.354] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0076.354] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0076.355] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0076.355] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0076.356] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0076.356] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0076.357] lstrlenW (lpString="taskhost.exe") returned 12
	[0076.357] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0076.358] lstrlenW (lpString="dllhost.exe") returned 11
	[0076.358] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0076.359] lstrlenW (lpString="dllhost.exe") returned 11
	[0076.359] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0076.360] lstrlenW (lpString="000005.exe") returned 10
	[0076.360] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0076.361] lstrlenW (lpString="cmd.exe") returned 7
	[0076.361] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0076.362] lstrlenW (lpString="conhost.exe") returned 11
	[0076.362] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0076.410] lstrlenW (lpString="vssadmin.exe") returned 12
	[0076.411] Process32NextW (in: hSnapshot=0x19c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0076.412] CloseHandle (hObject=0x19c) returned 1
	[0076.412] Sleep (dwMilliseconds=0x1f4) 
	[0076.978] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339ce0
	[0076.979] EnumServicesStatusExW (in: hSCManager=0x339ce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0076.979] GetLastError () returned 0xea
	[0076.979] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x11e4) returned 0x36b4538
	[0076.980] EnumServicesStatusExW (in: hSCManager=0x339ce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36b4538, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36b4538, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0076.981] CloseServiceHandle (hSCObject=0x339ce0) returned 1
	[0076.981] lstrlenW (lpString="Appinfo") returned 7
	[0076.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0076.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0076.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0076.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0076.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0076.982] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0076.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0076.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0076.982] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0076.982] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0076.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0076.983] lstrlenW (lpString="AudioSrv") returned 8
	[0076.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0076.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0076.983] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0076.983] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0076.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0076.983] lstrlenW (lpString="BFE") returned 3
	[0076.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0076.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0076.984] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0076.984] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0076.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0076.984] lstrlenW (lpString="CryptSvc") returned 8
	[0076.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0076.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0076.985] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0076.985] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0076.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0076.985] lstrlenW (lpString="CscService") returned 10
	[0076.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0076.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0076.985] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0076.985] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0076.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0076.986] lstrlenW (lpString="DcomLaunch") returned 10
	[0076.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0076.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0076.986] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0076.986] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0076.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0076.987] lstrlenW (lpString="Dhcp") returned 4
	[0076.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0076.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0076.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0076.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0076.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0076.987] lstrlenW (lpString="Dnscache") returned 8
	[0076.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0076.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0076.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0076.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0076.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0076.988] lstrlenW (lpString="DPS") returned 3
	[0076.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0076.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0076.988] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0076.988] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0076.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0076.989] lstrlenW (lpString="eventlog") returned 8
	[0076.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0076.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0076.989] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0076.989] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0076.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0076.989] lstrlenW (lpString="EventSystem") returned 11
	[0076.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0076.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0076.990] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0076.990] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0076.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0076.990] lstrlenW (lpString="gpsvc") returned 5
	[0076.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0076.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0076.991] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0076.991] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0076.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0076.991] lstrlenW (lpString="iphlpsvc") returned 8
	[0076.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0076.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0076.992] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0076.992] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0076.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0076.992] lstrlenW (lpString="LanmanServer") returned 12
	[0076.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0076.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0076.992] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0076.992] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0076.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0076.993] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0076.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0076.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0076.993] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0076.993] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0076.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0076.994] lstrlenW (lpString="lmhosts") returned 7
	[0076.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0076.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0076.994] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0076.994] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0076.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0076.994] lstrlenW (lpString="MMCSS") returned 5
	[0076.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0076.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0076.995] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0076.995] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0076.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0076.995] lstrlenW (lpString="MpsSvc") returned 6
	[0076.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0076.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0076.996] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0076.996] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0076.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0076.996] lstrlenW (lpString="Netman") returned 6
	[0076.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0076.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0076.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0076.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0076.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0076.997] lstrlenW (lpString="netprofm") returned 8
	[0076.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0076.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0076.997] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0076.997] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0076.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0076.998] lstrlenW (lpString="NlaSvc") returned 6
	[0076.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0076.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0076.998] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0076.998] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0076.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0076.998] lstrlenW (lpString="nsi") returned 3
	[0076.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0076.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0076.999] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0076.999] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0076.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0076.999] lstrlenW (lpString="PcaSvc") returned 6
	[0076.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0076.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0077.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0077.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0077.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0077.000] lstrlenW (lpString="PlugPlay") returned 8
	[0077.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0077.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0077.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0077.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0077.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0077.001] lstrlenW (lpString="Power") returned 5
	[0077.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0077.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0077.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0077.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0077.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0077.002] lstrlenW (lpString="ProfSvc") returned 7
	[0077.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0077.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0077.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0077.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0077.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0077.003] lstrlenW (lpString="RpcEptMapper") returned 12
	[0077.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0077.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0077.003] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0077.003] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0077.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0077.003] lstrlenW (lpString="RpcSs") returned 5
	[0077.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0077.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0077.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0077.004] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0077.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0077.004] lstrlenW (lpString="SamSs") returned 5
	[0077.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0077.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0077.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0077.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0077.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0077.005] lstrlenW (lpString="Schedule") returned 8
	[0077.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0077.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0077.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0077.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0077.006] lstrlenW (lpString="SENS") returned 4
	[0077.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0077.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0077.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0077.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0077.007] lstrlenW (lpString="ShellHWDetection") returned 16
	[0077.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0077.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0077.007] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0077.007] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0077.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0077.008] lstrlenW (lpString="Spooler") returned 7
	[0077.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0077.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0077.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0077.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0077.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0077.008] lstrlenW (lpString="SysMain") returned 7
	[0077.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0077.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0077.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0077.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0077.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0077.009] lstrlenW (lpString="Themes") returned 6
	[0077.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0077.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0077.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0077.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0077.010] lstrlenW (lpString="TrkWks") returned 6
	[0077.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0077.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0077.011] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0077.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0077.011] lstrlenW (lpString="UxSms") returned 5
	[0077.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0077.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0077.011] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0077.012] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0077.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0077.012] lstrlenW (lpString="WdiServiceHost") returned 14
	[0077.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0077.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0077.012] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0077.013] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0077.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0077.013] lstrlenW (lpString="WdiSystemHost") returned 13
	[0077.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0077.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0077.013] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0077.013] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0077.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0077.014] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0077.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0077.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0077.014] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0077.014] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0077.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0077.015] lstrlenW (lpString="Winmgmt") returned 7
	[0077.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0077.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0077.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0077.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0077.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0077.016] lstrlenW (lpString="WPDBusEnum") returned 10
	[0077.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0077.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0077.016] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0077.016] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0077.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0077.017] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36b4538 | out: hHeap=0x2e0000) returned 1
	[0077.017] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8
	[0077.139] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0077.141] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0077.141] lstrlenW (lpString="System") returned 6
	[0077.142] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0077.142] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0077.142] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0077.142] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0077.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0077.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0077.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0077.143] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0077.144] lstrlenW (lpString="smss.exe") returned 8
	[0077.144] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0077.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0077.144] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0077.144] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0077.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0077.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0077.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0077.145] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0077.146] lstrlenW (lpString="csrss.exe") returned 9
	[0077.146] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0077.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0077.146] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0077.147] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0077.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0077.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0077.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0077.147] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0077.148] lstrlenW (lpString="wininit.exe") returned 11
	[0077.148] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0077.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0077.149] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0077.149] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0077.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0077.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0077.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0077.149] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0077.150] lstrlenW (lpString="csrss.exe") returned 9
	[0077.150] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0077.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0077.151] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0077.151] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0077.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0077.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0077.151] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0077.152] lstrlenW (lpString="winlogon.exe") returned 12
	[0077.152] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0077.153] lstrlenW (lpString="services.exe") returned 12
	[0077.153] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0077.154] lstrlenW (lpString="lsass.exe") returned 9
	[0077.154] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0077.155] lstrlenW (lpString="lsm.exe") returned 7
	[0077.155] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.156] lstrlenW (lpString="svchost.exe") returned 11
	[0077.156] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.157] lstrlenW (lpString="svchost.exe") returned 11
	[0077.157] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.158] lstrlenW (lpString="svchost.exe") returned 11
	[0077.158] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.158] lstrlenW (lpString="svchost.exe") returned 11
	[0077.159] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.159] lstrlenW (lpString="svchost.exe") returned 11
	[0077.159] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0077.160] lstrlenW (lpString="audiodg.exe") returned 11
	[0077.160] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.161] lstrlenW (lpString="svchost.exe") returned 11
	[0077.161] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.162] lstrlenW (lpString="svchost.exe") returned 11
	[0077.162] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0077.163] lstrlenW (lpString="dwm.exe") returned 7
	[0077.163] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0077.164] lstrlenW (lpString="explorer.exe") returned 12
	[0077.164] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0077.164] lstrlenW (lpString="spoolsv.exe") returned 11
	[0077.165] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.165] lstrlenW (lpString="svchost.exe") returned 11
	[0077.165] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0077.166] lstrlenW (lpString="taskhost.exe") returned 12
	[0077.166] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0077.167] lstrlenW (lpString="taskeng.exe") returned 11
	[0077.167] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0077.168] lstrlenW (lpString="elliott grace.exe") returned 17
	[0077.168] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0077.169] lstrlenW (lpString="floyd.exe") returned 9
	[0077.169] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0077.169] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0077.170] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0077.170] lstrlenW (lpString="bond.exe") returned 8
	[0077.170] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0077.171] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0077.171] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0077.172] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0077.172] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0077.173] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0077.173] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0077.300] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0077.528] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0077.528] lstrlenW (lpString="wheel_year.exe") returned 14
	[0077.529] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0077.529] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0077.530] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0077.531] lstrlenW (lpString="alifilm.exe") returned 11
	[0077.531] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0077.532] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0077.532] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0077.533] lstrlenW (lpString="orchestra.exe") returned 13
	[0077.533] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0077.534] lstrlenW (lpString="decade.exe") returned 10
	[0077.534] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0077.535] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0077.536] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0077.537] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0077.538] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0077.539] lstrlenW (lpString="bracket das.exe") returned 15
	[0077.539] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0077.540] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0077.540] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0077.541] lstrlenW (lpString="3dftp.exe") returned 9
	[0077.541] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0077.542] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0077.542] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0077.543] lstrlenW (lpString="alftp.exe") returned 9
	[0077.543] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0077.544] lstrlenW (lpString="barca.exe") returned 9
	[0077.544] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0077.545] lstrlenW (lpString="bitkinex.exe") returned 12
	[0077.546] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0077.546] lstrlenW (lpString="coreftp.exe") returned 11
	[0077.547] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0077.547] lstrlenW (lpString="far.exe") returned 7
	[0077.548] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0077.549] lstrlenW (lpString="filezilla.exe") returned 13
	[0077.549] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0077.550] lstrlenW (lpString="flashfxp.exe") returned 12
	[0077.550] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0077.551] lstrlenW (lpString="fling.exe") returned 9
	[0077.551] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0077.552] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0077.553] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0077.553] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0077.554] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0077.555] lstrlenW (lpString="icq.exe") returned 7
	[0077.555] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0077.556] lstrlenW (lpString="leechftp.exe") returned 12
	[0077.556] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0077.557] lstrlenW (lpString="ncftp.exe") returned 9
	[0077.557] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0077.558] lstrlenW (lpString="notepad.exe") returned 11
	[0077.558] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0077.559] lstrlenW (lpString="operamail.exe") returned 13
	[0077.559] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0077.560] lstrlenW (lpString="pidgin.exe") returned 10
	[0077.560] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0077.561] lstrlenW (lpString="scriptftp.exe") returned 13
	[0077.562] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0077.563] lstrlenW (lpString="skype.exe") returned 9
	[0077.563] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0077.717] lstrlenW (lpString="smartftp.exe") returned 12
	[0077.717] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0077.718] lstrlenW (lpString="thunderbird.exe") returned 15
	[0077.718] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0077.719] lstrlenW (lpString="totalcmd.exe") returned 12
	[0077.719] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0077.720] lstrlenW (lpString="trillian.exe") returned 12
	[0077.720] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0077.721] lstrlenW (lpString="webdrive.exe") returned 12
	[0077.721] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0077.722] lstrlenW (lpString="whatsapp.exe") returned 12
	[0077.722] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0077.723] lstrlenW (lpString="winscp.exe") returned 10
	[0077.723] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0077.724] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0077.724] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0077.725] lstrlenW (lpString="active-charge.exe") returned 17
	[0077.725] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0077.726] lstrlenW (lpString="accupos.exe") returned 11
	[0077.727] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0077.727] lstrlenW (lpString="afr38.exe") returned 9
	[0077.728] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0077.729] lstrlenW (lpString="aldelo.exe") returned 10
	[0077.729] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0077.730] lstrlenW (lpString="ccv_server.exe") returned 14
	[0077.730] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0077.731] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0077.731] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0077.732] lstrlenW (lpString="creditservice.exe") returned 17
	[0077.732] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0077.733] lstrlenW (lpString="edcsvr.exe") returned 10
	[0077.733] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0077.734] lstrlenW (lpString="fpos.exe") returned 8
	[0077.734] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0077.735] lstrlenW (lpString="isspos.exe") returned 10
	[0077.735] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0077.736] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0077.736] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0077.737] lstrlenW (lpString="omnipos.exe") returned 11
	[0077.737] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0077.738] lstrlenW (lpString="spcwin.exe") returned 10
	[0077.739] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0077.739] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0077.740] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0077.740] lstrlenW (lpString="utg2.exe") returned 8
	[0077.741] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0077.742] lstrlenW (lpString="interventions.exe") returned 17
	[0077.742] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0077.743] lstrlenW (lpString="hayes.exe") returned 9
	[0077.743] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0077.744] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0077.744] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0077.745] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0077.745] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0077.746] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0077.746] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0077.747] lstrlenW (lpString="taskhost.exe") returned 12
	[0077.747] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0077.748] lstrlenW (lpString="dllhost.exe") returned 11
	[0077.748] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0077.749] lstrlenW (lpString="000005.exe") returned 10
	[0077.749] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0077.750] lstrlenW (lpString="cmd.exe") returned 7
	[0077.751] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.950] lstrlenW (lpString="conhost.exe") returned 11
	[0077.951] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0077.952] lstrlenW (lpString="vssadmin.exe") returned 12
	[0077.952] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0077.953] CloseHandle (hObject=0x1c8) returned 1
	[0077.953] Sleep (dwMilliseconds=0x1f4) 
	[0078.778] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e20
	[0078.779] EnumServicesStatusExW (in: hSCManager=0x339e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0078.780] GetLastError () returned 0xea
	[0078.780] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x123e) returned 0x3f66000
	[0078.780] EnumServicesStatusExW (in: hSCManager=0x339e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f66000, cbBufSize=0x123e, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f66000, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0078.782] CloseServiceHandle (hSCObject=0x339e20) returned 1
	[0078.782] lstrlenW (lpString="Appinfo") returned 7
	[0078.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0078.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0078.783] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0078.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0078.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0078.783] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0078.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0078.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0078.784] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0078.784] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0078.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0078.784] lstrlenW (lpString="AudioSrv") returned 8
	[0078.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0078.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0078.786] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0078.786] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0078.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0078.787] lstrlenW (lpString="BFE") returned 3
	[0078.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0078.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0078.787] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0078.787] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0078.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0078.788] lstrlenW (lpString="CryptSvc") returned 8
	[0078.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0078.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0078.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0078.789] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0078.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0078.789] lstrlenW (lpString="CscService") returned 10
	[0078.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0078.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0078.789] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0078.790] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0078.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0078.790] lstrlenW (lpString="DcomLaunch") returned 10
	[0078.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0078.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0078.791] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0078.791] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0078.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0078.791] lstrlenW (lpString="Dhcp") returned 4
	[0078.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0078.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0078.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0078.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0078.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0078.792] lstrlenW (lpString="Dnscache") returned 8
	[0078.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0078.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0078.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0078.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0078.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0078.796] lstrlenW (lpString="DPS") returned 3
	[0078.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0078.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0078.797] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0078.797] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0078.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0078.797] lstrlenW (lpString="eventlog") returned 8
	[0078.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0078.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0078.798] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0078.798] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0078.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0078.798] lstrlenW (lpString="EventSystem") returned 11
	[0078.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0078.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0078.799] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0078.799] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0078.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0078.799] lstrlenW (lpString="gpsvc") returned 5
	[0078.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0078.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0078.800] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0078.800] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0078.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0078.800] lstrlenW (lpString="iphlpsvc") returned 8
	[0078.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0078.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0078.800] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0078.801] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0078.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0078.801] lstrlenW (lpString="LanmanServer") returned 12
	[0078.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0078.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0078.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0078.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0078.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0078.802] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0078.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0078.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0078.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0078.803] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0078.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0078.803] lstrlenW (lpString="lmhosts") returned 7
	[0078.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0078.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0078.803] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0078.804] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0078.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0078.804] lstrlenW (lpString="MMCSS") returned 5
	[0078.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0078.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0078.804] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0078.804] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0078.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0078.805] lstrlenW (lpString="MpsSvc") returned 6
	[0078.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0078.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0078.805] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0078.805] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0078.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0078.806] lstrlenW (lpString="Netman") returned 6
	[0078.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0078.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0078.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0078.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0078.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0078.807] lstrlenW (lpString="netprofm") returned 8
	[0078.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0078.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0078.807] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0078.807] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0078.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0078.807] lstrlenW (lpString="NlaSvc") returned 6
	[0078.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0078.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0078.808] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0078.808] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0078.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0078.808] lstrlenW (lpString="nsi") returned 3
	[0078.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0078.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0078.809] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0078.809] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0078.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0078.809] lstrlenW (lpString="PcaSvc") returned 6
	[0078.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0078.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0078.809] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0078.810] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0078.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0078.810] lstrlenW (lpString="PlugPlay") returned 8
	[0078.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0078.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0078.810] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0078.810] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0078.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0078.811] lstrlenW (lpString="Power") returned 5
	[0078.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0078.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0078.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0078.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0078.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0078.812] lstrlenW (lpString="ProfSvc") returned 7
	[0078.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0078.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0078.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0078.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0078.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0078.813] lstrlenW (lpString="RpcEptMapper") returned 12
	[0078.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0078.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0078.813] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0078.813] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0079.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0079.282] lstrlenW (lpString="RpcSs") returned 5
	[0079.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0079.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0079.283] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0079.283] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0079.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0079.283] lstrlenW (lpString="SamSs") returned 5
	[0079.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0079.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0079.284] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0079.284] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0079.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0079.284] lstrlenW (lpString="Schedule") returned 8
	[0079.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0079.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0079.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0079.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0079.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0079.285] lstrlenW (lpString="SENS") returned 4
	[0079.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0079.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0079.286] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0079.286] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0079.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0079.286] lstrlenW (lpString="ShellHWDetection") returned 16
	[0079.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0079.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0079.287] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0079.287] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0079.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0079.287] lstrlenW (lpString="Spooler") returned 7
	[0079.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0079.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0079.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0079.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0079.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0079.288] lstrlenW (lpString="SysMain") returned 7
	[0079.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0079.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0079.288] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0079.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0079.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0079.289] lstrlenW (lpString="Themes") returned 6
	[0079.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0079.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0079.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0079.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0079.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0079.290] lstrlenW (lpString="TrkWks") returned 6
	[0079.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0079.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0079.290] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0079.290] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0079.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0079.290] lstrlenW (lpString="UxSms") returned 5
	[0079.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0079.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0079.291] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0079.291] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0079.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0079.291] lstrlenW (lpString="VSS") returned 3
	[0079.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0079.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0079.292] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0079.292] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0079.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0079.292] lstrlenW (lpString="WdiServiceHost") returned 14
	[0079.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0079.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0079.293] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0079.293] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0079.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0079.293] lstrlenW (lpString="WdiSystemHost") returned 13
	[0079.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0079.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0079.293] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0079.294] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0079.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0079.294] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0079.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0079.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0079.294] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0079.294] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0079.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0079.295] lstrlenW (lpString="Winmgmt") returned 7
	[0079.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0079.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0079.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0079.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0079.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0079.296] lstrlenW (lpString="WPDBusEnum") returned 10
	[0079.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0079.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0079.297] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0079.297] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0079.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0079.297] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f66000 | out: hHeap=0x2e0000) returned 1
	[0079.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc
	[0079.304] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0079.304] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0079.305] lstrlenW (lpString="System") returned 6
	[0079.305] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0079.305] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0079.306] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0079.306] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0079.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0079.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0079.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0079.306] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0079.307] lstrlenW (lpString="smss.exe") returned 8
	[0079.307] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0079.307] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0079.307] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0079.308] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0079.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0079.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0079.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0079.308] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0079.309] lstrlenW (lpString="csrss.exe") returned 9
	[0079.309] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0079.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0079.309] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0079.309] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0079.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0079.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0079.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0079.310] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0079.311] lstrlenW (lpString="wininit.exe") returned 11
	[0079.311] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0079.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0079.311] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0079.312] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0079.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0079.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0079.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0079.312] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0079.313] lstrlenW (lpString="csrss.exe") returned 9
	[0079.313] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0079.313] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0079.314] lstrlenW (lpString="winlogon.exe") returned 12
	[0079.314] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0079.315] lstrlenW (lpString="services.exe") returned 12
	[0079.315] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0079.316] lstrlenW (lpString="lsass.exe") returned 9
	[0079.316] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0079.317] lstrlenW (lpString="lsm.exe") returned 7
	[0079.317] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.318] lstrlenW (lpString="svchost.exe") returned 11
	[0079.318] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.318] lstrlenW (lpString="svchost.exe") returned 11
	[0079.319] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.319] lstrlenW (lpString="svchost.exe") returned 11
	[0079.320] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.320] lstrlenW (lpString="svchost.exe") returned 11
	[0079.320] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.321] lstrlenW (lpString="svchost.exe") returned 11
	[0079.321] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0079.322] lstrlenW (lpString="audiodg.exe") returned 11
	[0079.322] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.323] lstrlenW (lpString="svchost.exe") returned 11
	[0079.323] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.323] lstrlenW (lpString="svchost.exe") returned 11
	[0079.324] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0079.324] lstrlenW (lpString="dwm.exe") returned 7
	[0079.325] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0079.325] lstrlenW (lpString="explorer.exe") returned 12
	[0079.325] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0079.326] lstrlenW (lpString="spoolsv.exe") returned 11
	[0079.815] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.816] lstrlenW (lpString="svchost.exe") returned 11
	[0079.816] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0079.817] lstrlenW (lpString="taskhost.exe") returned 12
	[0079.817] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0079.818] lstrlenW (lpString="taskeng.exe") returned 11
	[0079.818] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0079.819] lstrlenW (lpString="elliott grace.exe") returned 17
	[0079.819] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0079.820] lstrlenW (lpString="floyd.exe") returned 9
	[0079.820] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0079.821] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0079.821] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0079.822] lstrlenW (lpString="bond.exe") returned 8
	[0079.822] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0079.823] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0079.823] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0079.824] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0079.824] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0079.825] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0079.825] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0079.826] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0079.826] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0079.827] lstrlenW (lpString="wheel_year.exe") returned 14
	[0079.827] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0079.827] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0079.828] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0079.828] lstrlenW (lpString="alifilm.exe") returned 11
	[0079.829] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0079.829] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0079.829] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0079.830] lstrlenW (lpString="orchestra.exe") returned 13
	[0079.830] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0079.831] lstrlenW (lpString="decade.exe") returned 10
	[0079.831] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0079.832] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0079.832] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0079.833] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0079.833] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0079.834] lstrlenW (lpString="bracket das.exe") returned 15
	[0079.834] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0079.835] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0079.835] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0079.836] lstrlenW (lpString="3dftp.exe") returned 9
	[0079.836] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0079.837] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0079.837] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0079.837] lstrlenW (lpString="alftp.exe") returned 9
	[0079.838] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0079.838] lstrlenW (lpString="barca.exe") returned 9
	[0079.839] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0079.840] lstrlenW (lpString="bitkinex.exe") returned 12
	[0079.840] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0079.841] lstrlenW (lpString="coreftp.exe") returned 11
	[0079.841] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0079.842] lstrlenW (lpString="far.exe") returned 7
	[0079.842] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0079.843] lstrlenW (lpString="filezilla.exe") returned 13
	[0079.843] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0079.844] lstrlenW (lpString="flashfxp.exe") returned 12
	[0079.844] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0079.845] lstrlenW (lpString="fling.exe") returned 9
	[0079.845] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0079.846] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0079.846] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0079.846] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0079.847] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0079.847] lstrlenW (lpString="icq.exe") returned 7
	[0079.848] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0079.848] lstrlenW (lpString="leechftp.exe") returned 12
	[0079.848] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0080.062] lstrlenW (lpString="ncftp.exe") returned 9
	[0080.063] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0080.063] lstrlenW (lpString="notepad.exe") returned 11
	[0080.064] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0080.065] lstrlenW (lpString="operamail.exe") returned 13
	[0080.065] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0080.066] lstrlenW (lpString="pidgin.exe") returned 10
	[0080.066] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0080.067] lstrlenW (lpString="scriptftp.exe") returned 13
	[0080.067] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0080.068] lstrlenW (lpString="skype.exe") returned 9
	[0080.068] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0080.069] lstrlenW (lpString="smartftp.exe") returned 12
	[0080.069] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0080.070] lstrlenW (lpString="thunderbird.exe") returned 15
	[0080.070] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0080.071] lstrlenW (lpString="totalcmd.exe") returned 12
	[0080.072] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0080.072] lstrlenW (lpString="trillian.exe") returned 12
	[0080.073] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0080.073] lstrlenW (lpString="webdrive.exe") returned 12
	[0080.074] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0080.075] lstrlenW (lpString="whatsapp.exe") returned 12
	[0080.075] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0080.076] lstrlenW (lpString="winscp.exe") returned 10
	[0080.076] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0080.077] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0080.077] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0080.078] lstrlenW (lpString="active-charge.exe") returned 17
	[0080.078] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0080.079] lstrlenW (lpString="accupos.exe") returned 11
	[0080.079] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0080.080] lstrlenW (lpString="afr38.exe") returned 9
	[0080.080] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0080.081] lstrlenW (lpString="aldelo.exe") returned 10
	[0080.082] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0080.082] lstrlenW (lpString="ccv_server.exe") returned 14
	[0080.083] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0080.083] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0080.084] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0080.085] lstrlenW (lpString="creditservice.exe") returned 17
	[0080.085] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0080.086] lstrlenW (lpString="edcsvr.exe") returned 10
	[0080.086] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0080.087] lstrlenW (lpString="fpos.exe") returned 8
	[0080.087] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0080.088] lstrlenW (lpString="isspos.exe") returned 10
	[0080.088] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0080.089] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0080.089] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0080.090] lstrlenW (lpString="omnipos.exe") returned 11
	[0080.090] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0080.091] lstrlenW (lpString="spcwin.exe") returned 10
	[0080.091] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0080.092] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0080.092] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0080.093] lstrlenW (lpString="utg2.exe") returned 8
	[0080.094] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0080.094] lstrlenW (lpString="interventions.exe") returned 17
	[0080.095] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0080.096] lstrlenW (lpString="hayes.exe") returned 9
	[0080.096] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0080.097] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0080.097] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0080.098] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0080.098] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0080.337] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0080.338] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0080.338] lstrlenW (lpString="taskhost.exe") returned 12
	[0080.339] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0080.339] lstrlenW (lpString="000005.exe") returned 10
	[0080.340] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0080.341] lstrlenW (lpString="cmd.exe") returned 7
	[0080.341] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0080.342] lstrlenW (lpString="conhost.exe") returned 11
	[0080.342] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0080.343] lstrlenW (lpString="vssadmin.exe") returned 12
	[0080.343] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0080.344] lstrlenW (lpString="VSSVC.exe") returned 9
	[0080.344] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0080.345] CloseHandle (hObject=0x1fc) returned 1
	[0080.345] Sleep (dwMilliseconds=0x1f4) 
	[0080.904] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0080.904] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0080.905] GetLastError () returned 0xea
	[0080.905] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x123e) returned 0x32e7b0
	[0080.905] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x123e, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0080.906] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0080.907] lstrlenW (lpString="Appinfo") returned 7
	[0080.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0080.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0080.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0080.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0080.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0080.908] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0080.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0080.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0080.908] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0080.908] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0080.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0080.909] lstrlenW (lpString="AudioSrv") returned 8
	[0080.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0080.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0080.909] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0080.909] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0080.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0080.910] lstrlenW (lpString="BFE") returned 3
	[0080.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0080.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0080.910] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0080.910] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0080.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0080.911] lstrlenW (lpString="CryptSvc") returned 8
	[0080.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0080.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0080.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0080.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0080.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0080.911] lstrlenW (lpString="CscService") returned 10
	[0080.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0080.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0080.912] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0080.912] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0080.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0080.912] lstrlenW (lpString="DcomLaunch") returned 10
	[0080.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0080.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0080.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0080.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0080.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0080.913] lstrlenW (lpString="Dhcp") returned 4
	[0080.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0080.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0080.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0080.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0080.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0080.914] lstrlenW (lpString="Dnscache") returned 8
	[0080.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0080.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0080.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0080.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0080.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0080.915] lstrlenW (lpString="DPS") returned 3
	[0080.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0080.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0080.915] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0080.916] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0080.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0080.916] lstrlenW (lpString="eventlog") returned 8
	[0080.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0080.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0080.916] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0080.916] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0080.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0080.917] lstrlenW (lpString="EventSystem") returned 11
	[0080.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0080.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0080.917] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0080.917] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0080.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0080.918] lstrlenW (lpString="gpsvc") returned 5
	[0080.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0080.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0080.918] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0080.918] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0080.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0080.919] lstrlenW (lpString="iphlpsvc") returned 8
	[0080.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0080.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0080.919] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0080.919] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0080.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0080.919] lstrlenW (lpString="LanmanServer") returned 12
	[0080.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0080.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0080.920] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0080.920] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0080.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0080.920] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0080.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0080.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0080.920] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0080.921] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0080.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0080.921] lstrlenW (lpString="lmhosts") returned 7
	[0080.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0080.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0080.921] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0080.921] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0080.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0080.921] lstrlenW (lpString="MMCSS") returned 5
	[0080.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0080.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0080.922] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0080.922] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0080.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0080.922] lstrlenW (lpString="MpsSvc") returned 6
	[0080.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0080.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0080.922] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0080.923] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0080.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0080.923] lstrlenW (lpString="Netman") returned 6
	[0080.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0080.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0080.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0080.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0080.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0080.924] lstrlenW (lpString="netprofm") returned 8
	[0080.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0080.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0080.924] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0080.924] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0080.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0080.924] lstrlenW (lpString="NlaSvc") returned 6
	[0080.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0080.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0080.925] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0080.925] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0080.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0080.925] lstrlenW (lpString="nsi") returned 3
	[0080.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0080.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0080.926] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0080.926] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0080.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0080.926] lstrlenW (lpString="PcaSvc") returned 6
	[0080.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0080.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0080.926] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0080.926] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0080.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0080.927] lstrlenW (lpString="PlugPlay") returned 8
	[0080.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0080.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0080.927] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0080.927] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0080.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0080.927] lstrlenW (lpString="Power") returned 5
	[0080.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0080.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0080.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0080.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0080.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0080.928] lstrlenW (lpString="ProfSvc") returned 7
	[0080.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0080.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0080.928] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0080.929] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0080.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0080.929] lstrlenW (lpString="RpcEptMapper") returned 12
	[0080.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0080.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0080.929] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0080.929] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0080.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0080.930] lstrlenW (lpString="RpcSs") returned 5
	[0080.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0080.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0080.930] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0080.930] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0080.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0080.930] lstrlenW (lpString="SamSs") returned 5
	[0080.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0080.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0080.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0080.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0080.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0080.931] lstrlenW (lpString="Schedule") returned 8
	[0080.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0080.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0080.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0080.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0080.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0080.932] lstrlenW (lpString="SENS") returned 4
	[0080.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0080.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0080.932] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0080.933] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0080.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0080.933] lstrlenW (lpString="ShellHWDetection") returned 16
	[0080.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0080.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0080.934] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0080.934] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0080.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0080.934] lstrlenW (lpString="Spooler") returned 7
	[0080.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0080.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0080.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0080.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0080.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0080.935] lstrlenW (lpString="SysMain") returned 7
	[0080.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0080.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0080.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0080.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0080.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0080.936] lstrlenW (lpString="Themes") returned 6
	[0080.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0080.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0080.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0080.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0080.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0080.937] lstrlenW (lpString="TrkWks") returned 6
	[0080.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0080.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0080.937] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0080.937] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0080.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0080.937] lstrlenW (lpString="UxSms") returned 5
	[0080.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0080.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0080.938] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0080.938] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0080.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0080.938] lstrlenW (lpString="VSS") returned 3
	[0080.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0080.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0080.939] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0080.939] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0080.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0080.939] lstrlenW (lpString="WdiServiceHost") returned 14
	[0080.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0080.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0080.939] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0080.939] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0080.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0080.940] lstrlenW (lpString="WdiSystemHost") returned 13
	[0080.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0080.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0080.940] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0080.940] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0080.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0080.941] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0080.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0080.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0080.941] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0080.941] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0080.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0080.941] lstrlenW (lpString="Winmgmt") returned 7
	[0080.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0080.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0080.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0080.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0080.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0080.942] lstrlenW (lpString="WPDBusEnum") returned 10
	[0080.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0080.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0080.943] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0080.943] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0080.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0080.943] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0080.943] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4
	[0081.281] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0081.282] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0081.282] lstrlenW (lpString="System") returned 6
	[0081.283] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0081.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0081.283] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0081.283] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0081.283] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0081.284] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0081.284] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0081.284] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0081.285] lstrlenW (lpString="smss.exe") returned 8
	[0081.285] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0081.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0081.285] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0081.285] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0081.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0081.286] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0081.286] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0081.286] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0081.287] lstrlenW (lpString="csrss.exe") returned 9
	[0081.287] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0081.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0081.287] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0081.287] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0081.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0081.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0081.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0081.288] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0081.289] lstrlenW (lpString="wininit.exe") returned 11
	[0081.289] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0081.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0081.289] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0081.289] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0081.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0081.290] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0081.290] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0081.290] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0081.291] lstrlenW (lpString="csrss.exe") returned 9
	[0081.291] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0081.291] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0081.292] lstrlenW (lpString="winlogon.exe") returned 12
	[0081.293] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0081.293] lstrlenW (lpString="services.exe") returned 12
	[0081.293] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0081.294] lstrlenW (lpString="lsass.exe") returned 9
	[0081.294] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0081.295] lstrlenW (lpString="lsm.exe") returned 7
	[0081.295] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.296] lstrlenW (lpString="svchost.exe") returned 11
	[0081.296] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.297] lstrlenW (lpString="svchost.exe") returned 11
	[0081.297] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.298] lstrlenW (lpString="svchost.exe") returned 11
	[0081.298] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.299] lstrlenW (lpString="svchost.exe") returned 11
	[0081.299] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.300] lstrlenW (lpString="svchost.exe") returned 11
	[0081.300] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0081.301] lstrlenW (lpString="audiodg.exe") returned 11
	[0081.301] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.302] lstrlenW (lpString="svchost.exe") returned 11
	[0081.302] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.302] lstrlenW (lpString="svchost.exe") returned 11
	[0081.302] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0081.303] lstrlenW (lpString="dwm.exe") returned 7
	[0081.303] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0081.305] lstrlenW (lpString="explorer.exe") returned 12
	[0081.305] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0081.305] lstrlenW (lpString="spoolsv.exe") returned 11
	[0081.306] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.306] lstrlenW (lpString="svchost.exe") returned 11
	[0081.306] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0081.307] lstrlenW (lpString="taskhost.exe") returned 12
	[0081.307] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0081.308] lstrlenW (lpString="taskeng.exe") returned 11
	[0081.308] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0081.309] lstrlenW (lpString="elliott grace.exe") returned 17
	[0081.309] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0081.310] lstrlenW (lpString="floyd.exe") returned 9
	[0081.310] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0081.311] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0081.311] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0081.312] lstrlenW (lpString="bond.exe") returned 8
	[0081.312] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0081.313] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0081.313] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0081.313] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0081.313] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0081.314] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0081.314] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0081.315] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0081.315] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0081.316] lstrlenW (lpString="wheel_year.exe") returned 14
	[0081.316] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0081.316] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0081.317] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0081.317] lstrlenW (lpString="alifilm.exe") returned 11
	[0081.317] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0081.318] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0081.318] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0081.319] lstrlenW (lpString="orchestra.exe") returned 13
	[0081.319] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0082.158] lstrlenW (lpString="decade.exe") returned 10
	[0082.158] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0082.158] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0082.159] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0082.159] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0082.159] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0082.160] lstrlenW (lpString="bracket das.exe") returned 15
	[0082.160] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0082.161] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0082.161] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0082.162] lstrlenW (lpString="3dftp.exe") returned 9
	[0082.163] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0082.163] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0082.163] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0082.164] lstrlenW (lpString="alftp.exe") returned 9
	[0082.164] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0082.165] lstrlenW (lpString="barca.exe") returned 9
	[0082.165] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0082.165] lstrlenW (lpString="bitkinex.exe") returned 12
	[0082.166] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0082.166] lstrlenW (lpString="coreftp.exe") returned 11
	[0082.166] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0082.167] lstrlenW (lpString="far.exe") returned 7
	[0082.167] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0082.168] lstrlenW (lpString="filezilla.exe") returned 13
	[0082.168] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0082.169] lstrlenW (lpString="flashfxp.exe") returned 12
	[0082.170] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0082.170] lstrlenW (lpString="fling.exe") returned 9
	[0082.171] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0082.172] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0082.172] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0082.173] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0082.173] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0082.174] lstrlenW (lpString="icq.exe") returned 7
	[0082.174] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0082.174] lstrlenW (lpString="leechftp.exe") returned 12
	[0082.175] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0082.175] lstrlenW (lpString="ncftp.exe") returned 9
	[0082.176] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0082.176] lstrlenW (lpString="notepad.exe") returned 11
	[0082.176] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0082.177] lstrlenW (lpString="operamail.exe") returned 13
	[0082.177] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0082.179] lstrlenW (lpString="pidgin.exe") returned 10
	[0082.179] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0082.180] lstrlenW (lpString="scriptftp.exe") returned 13
	[0082.180] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0082.181] lstrlenW (lpString="skype.exe") returned 9
	[0082.181] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0082.182] lstrlenW (lpString="smartftp.exe") returned 12
	[0082.182] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0082.183] lstrlenW (lpString="thunderbird.exe") returned 15
	[0082.183] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0082.184] lstrlenW (lpString="totalcmd.exe") returned 12
	[0082.184] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0082.185] lstrlenW (lpString="trillian.exe") returned 12
	[0082.185] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0082.186] lstrlenW (lpString="webdrive.exe") returned 12
	[0082.186] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0082.187] lstrlenW (lpString="whatsapp.exe") returned 12
	[0082.187] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0082.188] lstrlenW (lpString="winscp.exe") returned 10
	[0082.188] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0082.189] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0082.189] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0082.190] lstrlenW (lpString="active-charge.exe") returned 17
	[0082.190] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0082.192] lstrlenW (lpString="accupos.exe") returned 11
	[0082.192] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0082.193] lstrlenW (lpString="afr38.exe") returned 9
	[0082.193] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0082.194] lstrlenW (lpString="aldelo.exe") returned 10
	[0082.194] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0082.195] lstrlenW (lpString="ccv_server.exe") returned 14
	[0082.195] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0082.196] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0082.196] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0082.374] lstrlenW (lpString="creditservice.exe") returned 17
	[0082.374] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0082.375] lstrlenW (lpString="edcsvr.exe") returned 10
	[0082.376] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0082.376] lstrlenW (lpString="fpos.exe") returned 8
	[0082.376] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0082.377] lstrlenW (lpString="isspos.exe") returned 10
	[0082.377] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0082.378] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0082.378] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0082.379] lstrlenW (lpString="omnipos.exe") returned 11
	[0082.379] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0082.419] lstrlenW (lpString="spcwin.exe") returned 10
	[0082.420] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0082.420] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0082.421] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0082.421] lstrlenW (lpString="utg2.exe") returned 8
	[0082.421] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0082.422] lstrlenW (lpString="interventions.exe") returned 17
	[0082.422] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0082.423] lstrlenW (lpString="hayes.exe") returned 9
	[0082.423] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0082.425] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0082.425] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0082.426] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0082.426] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0082.427] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0082.427] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0082.427] lstrlenW (lpString="taskhost.exe") returned 12
	[0082.428] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0082.428] lstrlenW (lpString="000005.exe") returned 10
	[0082.428] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0082.440] lstrlenW (lpString="cmd.exe") returned 7
	[0082.440] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0082.442] lstrlenW (lpString="conhost.exe") returned 11
	[0082.442] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0082.443] lstrlenW (lpString="vssadmin.exe") returned 12
	[0082.443] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0082.443] lstrlenW (lpString="VSSVC.exe") returned 9
	[0082.444] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0082.444] CloseHandle (hObject=0x1f4) returned 1
	[0082.444] Sleep (dwMilliseconds=0x1f4) 
	[0083.929] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0083.930] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0083.930] GetLastError () returned 0xea
	[0083.930] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x123e) returned 0x32e7b0
	[0083.931] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x123e, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0083.932] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0083.933] lstrlenW (lpString="Appinfo") returned 7
	[0083.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0083.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0083.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0083.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0083.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0083.933] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0083.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0083.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0083.934] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0083.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0083.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0083.934] lstrlenW (lpString="AudioSrv") returned 8
	[0083.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0083.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0083.934] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0083.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0083.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0083.935] lstrlenW (lpString="BFE") returned 3
	[0083.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0083.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0083.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0083.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0083.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0083.935] lstrlenW (lpString="CryptSvc") returned 8
	[0083.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0083.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0083.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0083.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0083.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0083.936] lstrlenW (lpString="CscService") returned 10
	[0083.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0083.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0083.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0083.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0083.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0083.936] lstrlenW (lpString="DcomLaunch") returned 10
	[0083.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0083.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0083.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0083.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0083.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0083.937] lstrlenW (lpString="Dhcp") returned 4
	[0083.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0083.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0083.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0083.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0083.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0083.938] lstrlenW (lpString="Dnscache") returned 8
	[0083.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0083.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0083.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0083.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0083.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0083.938] lstrlenW (lpString="DPS") returned 3
	[0083.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0083.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0083.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0083.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0083.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0083.939] lstrlenW (lpString="eventlog") returned 8
	[0083.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0083.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0083.939] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0083.939] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0083.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0083.940] lstrlenW (lpString="EventSystem") returned 11
	[0083.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0083.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0083.940] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0083.940] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0083.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0083.940] lstrlenW (lpString="gpsvc") returned 5
	[0083.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0083.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0083.941] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0083.941] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0083.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0083.941] lstrlenW (lpString="iphlpsvc") returned 8
	[0083.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0083.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0083.941] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0083.942] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0083.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0083.942] lstrlenW (lpString="LanmanServer") returned 12
	[0083.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0083.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0083.942] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0083.942] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0083.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0083.943] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0083.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0083.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0083.943] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0083.943] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0083.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0083.943] lstrlenW (lpString="lmhosts") returned 7
	[0083.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0083.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0083.944] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0083.944] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0083.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0083.944] lstrlenW (lpString="MMCSS") returned 5
	[0083.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0083.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0083.944] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0083.945] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0083.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0083.945] lstrlenW (lpString="MpsSvc") returned 6
	[0083.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0083.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0083.945] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0083.945] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0083.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0083.945] lstrlenW (lpString="Netman") returned 6
	[0083.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0083.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0083.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0083.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0083.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0083.946] lstrlenW (lpString="netprofm") returned 8
	[0083.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0083.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0083.946] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0083.947] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0083.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0083.947] lstrlenW (lpString="NlaSvc") returned 6
	[0083.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0083.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0083.947] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0083.947] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0083.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0083.948] lstrlenW (lpString="nsi") returned 3
	[0083.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0083.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0083.948] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0083.948] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0083.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0083.948] lstrlenW (lpString="PcaSvc") returned 6
	[0083.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0083.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0083.949] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0083.949] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0083.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0083.949] lstrlenW (lpString="PlugPlay") returned 8
	[0083.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0083.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0083.949] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0083.949] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0083.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0083.950] lstrlenW (lpString="Power") returned 5
	[0083.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0083.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0083.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0083.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0083.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0083.950] lstrlenW (lpString="ProfSvc") returned 7
	[0083.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0083.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0083.951] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0083.951] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0083.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0083.951] lstrlenW (lpString="RpcEptMapper") returned 12
	[0083.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0083.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0083.951] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0083.951] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0083.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0083.952] lstrlenW (lpString="RpcSs") returned 5
	[0083.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0083.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0083.952] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0083.952] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0083.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0083.952] lstrlenW (lpString="SamSs") returned 5
	[0083.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0083.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0083.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0083.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0083.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0083.953] lstrlenW (lpString="Schedule") returned 8
	[0083.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0083.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0083.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0083.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0083.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0083.954] lstrlenW (lpString="SENS") returned 4
	[0083.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0083.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0083.954] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0083.954] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0083.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0083.954] lstrlenW (lpString="ShellHWDetection") returned 16
	[0083.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0083.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0083.955] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0083.955] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0083.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0083.955] lstrlenW (lpString="Spooler") returned 7
	[0083.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0083.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0083.956] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0083.956] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0083.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0083.956] lstrlenW (lpString="SysMain") returned 7
	[0083.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0083.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0083.956] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0083.956] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0083.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0083.957] lstrlenW (lpString="Themes") returned 6
	[0083.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0083.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0083.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0083.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0083.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0083.958] lstrlenW (lpString="TrkWks") returned 6
	[0083.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0083.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0083.958] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0083.958] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0083.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0083.958] lstrlenW (lpString="UxSms") returned 5
	[0083.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0083.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0083.959] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0083.959] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0083.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0083.959] lstrlenW (lpString="VSS") returned 3
	[0083.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0083.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0083.959] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0083.960] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0083.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0083.960] lstrlenW (lpString="WdiServiceHost") returned 14
	[0083.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0083.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0083.960] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0083.961] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0083.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0083.961] lstrlenW (lpString="WdiSystemHost") returned 13
	[0083.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0083.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0083.961] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0083.961] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0083.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0083.961] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0083.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0083.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0083.962] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0083.962] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0083.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0083.962] lstrlenW (lpString="Winmgmt") returned 7
	[0083.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0083.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0083.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0083.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0083.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0083.963] lstrlenW (lpString="WPDBusEnum") returned 10
	[0083.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0083.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0083.963] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0083.963] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0083.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0083.964] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0083.964] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208
	[0083.970] Process32FirstW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0083.970] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0083.971] lstrlenW (lpString="System") returned 6
	[0083.971] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0083.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0083.971] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0083.972] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0083.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0083.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0083.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0083.972] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0083.973] lstrlenW (lpString="smss.exe") returned 8
	[0083.973] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0083.973] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0083.973] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0083.973] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0083.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0083.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0083.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0083.974] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0083.975] lstrlenW (lpString="csrss.exe") returned 9
	[0083.975] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0083.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0084.068] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0084.068] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0084.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0084.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0084.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0084.069] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0084.069] lstrlenW (lpString="wininit.exe") returned 11
	[0084.069] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0084.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0084.070] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0084.070] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0084.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0084.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0084.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0084.070] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.071] lstrlenW (lpString="csrss.exe") returned 9
	[0084.071] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0084.071] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0084.072] lstrlenW (lpString="winlogon.exe") returned 12
	[0084.072] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0084.073] lstrlenW (lpString="services.exe") returned 12
	[0084.073] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0084.073] lstrlenW (lpString="lsass.exe") returned 9
	[0084.074] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0084.074] lstrlenW (lpString="lsm.exe") returned 7
	[0084.074] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.075] lstrlenW (lpString="svchost.exe") returned 11
	[0084.075] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.076] lstrlenW (lpString="svchost.exe") returned 11
	[0084.076] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.077] lstrlenW (lpString="svchost.exe") returned 11
	[0084.077] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.077] lstrlenW (lpString="svchost.exe") returned 11
	[0084.077] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.078] lstrlenW (lpString="svchost.exe") returned 11
	[0084.078] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0084.079] lstrlenW (lpString="audiodg.exe") returned 11
	[0084.079] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.080] lstrlenW (lpString="svchost.exe") returned 11
	[0084.080] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.080] lstrlenW (lpString="svchost.exe") returned 11
	[0084.080] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0084.081] lstrlenW (lpString="dwm.exe") returned 7
	[0084.081] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0084.082] lstrlenW (lpString="explorer.exe") returned 12
	[0084.082] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0084.082] lstrlenW (lpString="spoolsv.exe") returned 11
	[0084.082] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.083] lstrlenW (lpString="svchost.exe") returned 11
	[0084.083] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0084.084] lstrlenW (lpString="taskhost.exe") returned 12
	[0084.084] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0084.085] lstrlenW (lpString="taskeng.exe") returned 11
	[0084.085] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0084.086] lstrlenW (lpString="elliott grace.exe") returned 17
	[0084.086] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0084.087] lstrlenW (lpString="floyd.exe") returned 9
	[0084.087] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0084.087] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0084.087] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0084.088] lstrlenW (lpString="bond.exe") returned 8
	[0084.088] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0084.089] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0084.089] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0084.089] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0084.090] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0084.090] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0084.090] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0084.091] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0084.091] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0084.092] lstrlenW (lpString="wheel_year.exe") returned 14
	[0084.092] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0084.093] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0084.093] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0084.093] lstrlenW (lpString="alifilm.exe") returned 11
	[0084.094] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0084.094] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0084.094] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0084.095] lstrlenW (lpString="orchestra.exe") returned 13
	[0084.095] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0084.096] lstrlenW (lpString="decade.exe") returned 10
	[0084.096] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0084.096] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0084.096] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0084.097] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0084.097] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0084.098] lstrlenW (lpString="bracket das.exe") returned 15
	[0084.098] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0084.099] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0084.099] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0084.100] lstrlenW (lpString="3dftp.exe") returned 9
	[0084.100] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0084.179] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0084.180] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0084.180] lstrlenW (lpString="alftp.exe") returned 9
	[0084.180] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0084.181] lstrlenW (lpString="barca.exe") returned 9
	[0084.181] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0084.182] lstrlenW (lpString="bitkinex.exe") returned 12
	[0084.182] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0084.183] lstrlenW (lpString="coreftp.exe") returned 11
	[0084.183] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0084.184] lstrlenW (lpString="far.exe") returned 7
	[0084.184] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0084.184] lstrlenW (lpString="filezilla.exe") returned 13
	[0084.185] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0084.186] lstrlenW (lpString="flashfxp.exe") returned 12
	[0084.186] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0084.186] lstrlenW (lpString="fling.exe") returned 9
	[0084.187] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0084.187] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0084.187] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0084.188] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0084.188] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0084.189] lstrlenW (lpString="icq.exe") returned 7
	[0084.189] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0084.190] lstrlenW (lpString="leechftp.exe") returned 12
	[0084.190] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0084.190] lstrlenW (lpString="ncftp.exe") returned 9
	[0084.191] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0084.191] lstrlenW (lpString="notepad.exe") returned 11
	[0084.191] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0084.192] lstrlenW (lpString="operamail.exe") returned 13
	[0084.192] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0084.196] lstrlenW (lpString="pidgin.exe") returned 10
	[0084.196] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0084.197] lstrlenW (lpString="scriptftp.exe") returned 13
	[0084.197] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0084.198] lstrlenW (lpString="skype.exe") returned 9
	[0084.198] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0084.199] lstrlenW (lpString="smartftp.exe") returned 12
	[0084.200] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0084.200] lstrlenW (lpString="thunderbird.exe") returned 15
	[0084.201] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0084.201] lstrlenW (lpString="totalcmd.exe") returned 12
	[0084.202] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0084.202] lstrlenW (lpString="trillian.exe") returned 12
	[0084.203] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0084.203] lstrlenW (lpString="webdrive.exe") returned 12
	[0084.204] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0084.204] lstrlenW (lpString="whatsapp.exe") returned 12
	[0084.204] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0084.205] lstrlenW (lpString="winscp.exe") returned 10
	[0084.206] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0084.206] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0084.207] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0084.207] lstrlenW (lpString="active-charge.exe") returned 17
	[0084.208] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0084.208] lstrlenW (lpString="accupos.exe") returned 11
	[0084.209] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0084.210] lstrlenW (lpString="afr38.exe") returned 9
	[0084.210] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0084.211] lstrlenW (lpString="aldelo.exe") returned 10
	[0084.211] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0084.212] lstrlenW (lpString="ccv_server.exe") returned 14
	[0084.212] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0084.213] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0084.213] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0084.214] lstrlenW (lpString="creditservice.exe") returned 17
	[0084.214] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0084.234] lstrlenW (lpString="edcsvr.exe") returned 10
	[0084.234] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0084.235] lstrlenW (lpString="fpos.exe") returned 8
	[0084.235] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0084.236] lstrlenW (lpString="isspos.exe") returned 10
	[0084.236] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0084.237] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0084.237] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0084.238] lstrlenW (lpString="omnipos.exe") returned 11
	[0084.238] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0084.239] lstrlenW (lpString="spcwin.exe") returned 10
	[0084.239] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0084.239] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0084.240] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0084.240] lstrlenW (lpString="utg2.exe") returned 8
	[0084.241] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0084.241] lstrlenW (lpString="interventions.exe") returned 17
	[0084.241] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0084.242] lstrlenW (lpString="hayes.exe") returned 9
	[0084.242] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0084.243] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0084.243] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0084.244] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0084.244] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0084.245] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0084.245] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0084.246] lstrlenW (lpString="taskhost.exe") returned 12
	[0084.246] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0084.246] lstrlenW (lpString="000005.exe") returned 10
	[0084.247] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0084.247] lstrlenW (lpString="cmd.exe") returned 7
	[0084.247] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0084.248] lstrlenW (lpString="conhost.exe") returned 11
	[0084.248] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0084.249] lstrlenW (lpString="vssadmin.exe") returned 12
	[0084.249] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0084.250] lstrlenW (lpString="VSSVC.exe") returned 9
	[0084.250] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0084.251] CloseHandle (hObject=0x208) returned 1
	[0084.251] Sleep (dwMilliseconds=0x1f4) 
	[0084.756] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0084.756] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0084.757] GetLastError () returned 0xea
	[0084.757] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x123e) returned 0x32e7b0
	[0084.757] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x123e, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0084.758] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0084.759] lstrlenW (lpString="Appinfo") returned 7
	[0084.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0084.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0084.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0084.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0084.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0084.759] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0084.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.760] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0084.760] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0084.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0084.760] lstrlenW (lpString="AudioSrv") returned 8
	[0084.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0084.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0084.760] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0084.761] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0084.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0084.761] lstrlenW (lpString="BFE") returned 3
	[0084.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0084.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0084.761] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0084.761] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0084.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0084.761] lstrlenW (lpString="CryptSvc") returned 8
	[0084.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.762] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0084.762] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0084.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0084.762] lstrlenW (lpString="CscService") returned 10
	[0084.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0084.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0084.762] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0084.763] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0084.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0084.763] lstrlenW (lpString="DcomLaunch") returned 10
	[0084.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0084.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0084.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0084.763] lstrlenW (lpString="Dhcp") returned 4
	[0084.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0084.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0084.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0084.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0084.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0084.764] lstrlenW (lpString="Dnscache") returned 8
	[0084.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0084.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0084.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0084.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0084.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0084.765] lstrlenW (lpString="DPS") returned 3
	[0084.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0084.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0084.765] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0084.765] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0084.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0084.766] lstrlenW (lpString="eventlog") returned 8
	[0084.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0084.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0084.766] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0084.766] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0084.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0084.766] lstrlenW (lpString="EventSystem") returned 11
	[0084.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0084.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0084.766] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0084.767] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0084.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0084.767] lstrlenW (lpString="gpsvc") returned 5
	[0084.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0084.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0084.767] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0084.767] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0084.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0084.767] lstrlenW (lpString="iphlpsvc") returned 8
	[0084.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.768] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0084.768] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0084.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0084.768] lstrlenW (lpString="LanmanServer") returned 12
	[0084.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.768] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0084.768] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0084.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0084.769] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0084.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.769] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0084.769] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0084.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0084.769] lstrlenW (lpString="lmhosts") returned 7
	[0084.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0084.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0084.769] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0084.770] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0084.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0084.770] lstrlenW (lpString="MMCSS") returned 5
	[0084.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0084.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0084.770] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0084.770] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0084.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0084.770] lstrlenW (lpString="MpsSvc") returned 6
	[0084.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.771] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0084.771] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0084.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0084.771] lstrlenW (lpString="Netman") returned 6
	[0084.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0084.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0084.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0084.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0084.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0084.772] lstrlenW (lpString="netprofm") returned 8
	[0084.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0084.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0084.772] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0084.772] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0084.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0084.773] lstrlenW (lpString="NlaSvc") returned 6
	[0084.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.773] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0084.773] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0084.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0084.773] lstrlenW (lpString="nsi") returned 3
	[0084.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0084.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0084.774] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0084.774] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0084.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0084.774] lstrlenW (lpString="PcaSvc") returned 6
	[0084.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.774] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0084.774] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0084.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0084.775] lstrlenW (lpString="PlugPlay") returned 8
	[0084.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.775] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0084.775] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0084.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0084.775] lstrlenW (lpString="Power") returned 5
	[0084.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0084.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0084.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0084.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0084.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0084.776] lstrlenW (lpString="ProfSvc") returned 7
	[0084.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.776] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0084.776] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0084.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0084.777] lstrlenW (lpString="RpcEptMapper") returned 12
	[0084.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.777] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0084.777] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0084.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0084.777] lstrlenW (lpString="RpcSs") returned 5
	[0084.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0084.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0084.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0084.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0084.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0084.778] lstrlenW (lpString="SamSs") returned 5
	[0084.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0084.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0084.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0084.779] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0084.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0084.779] lstrlenW (lpString="Schedule") returned 8
	[0084.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0084.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0084.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0084.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0084.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0084.780] lstrlenW (lpString="SENS") returned 4
	[0084.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0084.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0084.780] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0084.780] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0084.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0084.780] lstrlenW (lpString="ShellHWDetection") returned 16
	[0084.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0084.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0084.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0084.781] lstrlenW (lpString="Spooler") returned 7
	[0084.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0084.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0084.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0084.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0084.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0084.782] lstrlenW (lpString="SysMain") returned 7
	[0084.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0084.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0084.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0084.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0084.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0084.782] lstrlenW (lpString="Themes") returned 6
	[0084.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0084.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0084.783] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0084.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0084.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0084.783] lstrlenW (lpString="TrkWks") returned 6
	[0084.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0084.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0084.783] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0084.783] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0084.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0084.784] lstrlenW (lpString="UxSms") returned 5
	[0084.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0084.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0084.784] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0084.784] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0084.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0084.784] lstrlenW (lpString="VSS") returned 3
	[0084.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0084.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0084.785] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0084.785] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0084.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0084.785] lstrlenW (lpString="WdiServiceHost") returned 14
	[0084.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0084.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0084.785] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0084.785] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0084.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0084.786] lstrlenW (lpString="WdiSystemHost") returned 13
	[0084.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0084.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0084.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0084.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0084.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0084.787] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0084.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.787] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.787] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0084.787] lstrlenW (lpString="Winmgmt") returned 7
	[0084.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0084.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0084.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0084.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0084.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0084.788] lstrlenW (lpString="WPDBusEnum") returned 10
	[0084.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0084.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0084.788] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0084.789] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0084.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0084.789] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0084.789] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208
	[0084.795] Process32FirstW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0084.795] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0084.796] lstrlenW (lpString="System") returned 6
	[0084.796] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0084.796] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0084.796] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0084.797] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0084.797] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0084.797] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0084.797] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0084.797] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0084.798] lstrlenW (lpString="smss.exe") returned 8
	[0084.798] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0084.798] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0084.798] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0084.798] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0084.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0084.798] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0084.798] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0084.798] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.799] lstrlenW (lpString="csrss.exe") returned 9
	[0084.799] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0084.799] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0084.799] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0084.799] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0084.800] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0084.800] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0084.800] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0084.800] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0084.801] lstrlenW (lpString="wininit.exe") returned 11
	[0084.801] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0084.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0084.801] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0084.801] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0084.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0084.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0084.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0084.802] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.812] lstrlenW (lpString="csrss.exe") returned 9
	[0084.812] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0084.812] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0084.813] lstrlenW (lpString="winlogon.exe") returned 12
	[0084.813] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0084.813] lstrlenW (lpString="services.exe") returned 12
	[0084.814] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0084.814] lstrlenW (lpString="lsass.exe") returned 9
	[0084.814] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0084.815] lstrlenW (lpString="lsm.exe") returned 7
	[0084.815] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.815] lstrlenW (lpString="svchost.exe") returned 11
	[0084.816] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.816] lstrlenW (lpString="svchost.exe") returned 11
	[0084.816] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.817] lstrlenW (lpString="svchost.exe") returned 11
	[0084.817] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.818] lstrlenW (lpString="svchost.exe") returned 11
	[0084.818] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.819] lstrlenW (lpString="svchost.exe") returned 11
	[0084.819] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0084.820] lstrlenW (lpString="audiodg.exe") returned 11
	[0084.820] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.820] lstrlenW (lpString="svchost.exe") returned 11
	[0084.820] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.821] lstrlenW (lpString="svchost.exe") returned 11
	[0084.821] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0084.822] lstrlenW (lpString="dwm.exe") returned 7
	[0084.822] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0084.822] lstrlenW (lpString="explorer.exe") returned 12
	[0084.822] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0084.823] lstrlenW (lpString="spoolsv.exe") returned 11
	[0084.823] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.825] lstrlenW (lpString="svchost.exe") returned 11
	[0084.825] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0084.826] lstrlenW (lpString="taskhost.exe") returned 12
	[0084.826] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0084.827] lstrlenW (lpString="taskeng.exe") returned 11
	[0084.827] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0084.828] lstrlenW (lpString="elliott grace.exe") returned 17
	[0084.828] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0084.828] lstrlenW (lpString="floyd.exe") returned 9
	[0084.829] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0084.829] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0084.829] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0084.830] lstrlenW (lpString="bond.exe") returned 8
	[0084.830] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0084.831] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0084.831] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0084.831] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0084.832] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0084.832] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0084.832] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0084.833] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0084.834] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0084.834] lstrlenW (lpString="wheel_year.exe") returned 14
	[0084.834] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0084.835] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0084.835] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0084.836] lstrlenW (lpString="alifilm.exe") returned 11
	[0084.836] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0084.837] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0084.837] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0084.837] lstrlenW (lpString="orchestra.exe") returned 13
	[0084.838] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0084.838] lstrlenW (lpString="decade.exe") returned 10
	[0084.838] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0084.839] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0084.839] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0084.840] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0084.840] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0084.841] lstrlenW (lpString="bracket das.exe") returned 15
	[0084.841] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0084.842] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0084.842] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0084.843] lstrlenW (lpString="3dftp.exe") returned 9
	[0084.843] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0084.844] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0084.844] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0084.844] lstrlenW (lpString="alftp.exe") returned 9
	[0084.845] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0084.845] lstrlenW (lpString="barca.exe") returned 9
	[0084.845] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0084.846] lstrlenW (lpString="bitkinex.exe") returned 12
	[0084.846] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0084.847] lstrlenW (lpString="coreftp.exe") returned 11
	[0084.847] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0084.847] lstrlenW (lpString="far.exe") returned 7
	[0084.847] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0084.848] lstrlenW (lpString="filezilla.exe") returned 13
	[0084.848] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0084.849] lstrlenW (lpString="flashfxp.exe") returned 12
	[0084.849] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0084.850] lstrlenW (lpString="fling.exe") returned 9
	[0084.850] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0084.851] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0084.851] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0084.852] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0084.852] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0084.852] lstrlenW (lpString="icq.exe") returned 7
	[0084.852] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0084.853] lstrlenW (lpString="leechftp.exe") returned 12
	[0084.853] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0084.854] lstrlenW (lpString="ncftp.exe") returned 9
	[0084.854] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0084.855] lstrlenW (lpString="notepad.exe") returned 11
	[0084.855] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0084.856] lstrlenW (lpString="operamail.exe") returned 13
	[0084.856] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0084.857] lstrlenW (lpString="pidgin.exe") returned 10
	[0084.857] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0084.858] lstrlenW (lpString="scriptftp.exe") returned 13
	[0084.858] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0084.859] lstrlenW (lpString="skype.exe") returned 9
	[0084.859] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0084.859] lstrlenW (lpString="smartftp.exe") returned 12
	[0084.860] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0084.860] lstrlenW (lpString="thunderbird.exe") returned 15
	[0084.861] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0084.861] lstrlenW (lpString="totalcmd.exe") returned 12
	[0084.861] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0084.862] lstrlenW (lpString="trillian.exe") returned 12
	[0084.862] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0084.863] lstrlenW (lpString="webdrive.exe") returned 12
	[0084.863] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0084.864] lstrlenW (lpString="whatsapp.exe") returned 12
	[0084.864] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0084.865] lstrlenW (lpString="winscp.exe") returned 10
	[0084.865] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0084.866] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0084.866] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0084.867] lstrlenW (lpString="active-charge.exe") returned 17
	[0084.867] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0084.867] lstrlenW (lpString="accupos.exe") returned 11
	[0084.868] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0084.868] lstrlenW (lpString="afr38.exe") returned 9
	[0084.868] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0084.869] lstrlenW (lpString="aldelo.exe") returned 10
	[0084.869] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0084.870] lstrlenW (lpString="ccv_server.exe") returned 14
	[0084.870] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0084.871] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0084.871] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0084.872] lstrlenW (lpString="creditservice.exe") returned 17
	[0084.872] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0084.872] lstrlenW (lpString="edcsvr.exe") returned 10
	[0084.873] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0084.873] lstrlenW (lpString="fpos.exe") returned 8
	[0084.874] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0084.874] lstrlenW (lpString="isspos.exe") returned 10
	[0084.874] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0084.875] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0084.899] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0084.899] lstrlenW (lpString="omnipos.exe") returned 11
	[0084.900] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0084.900] lstrlenW (lpString="spcwin.exe") returned 10
	[0084.901] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0084.901] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0084.902] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0084.902] lstrlenW (lpString="utg2.exe") returned 8
	[0084.903] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0084.903] lstrlenW (lpString="interventions.exe") returned 17
	[0084.904] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0084.904] lstrlenW (lpString="hayes.exe") returned 9
	[0084.904] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0084.905] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0084.906] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0084.906] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0084.906] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0084.907] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0084.907] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0084.908] lstrlenW (lpString="taskhost.exe") returned 12
	[0084.908] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0084.909] lstrlenW (lpString="000005.exe") returned 10
	[0084.909] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0084.910] lstrlenW (lpString="cmd.exe") returned 7
	[0084.910] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0084.911] lstrlenW (lpString="conhost.exe") returned 11
	[0084.911] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0084.912] lstrlenW (lpString="vssadmin.exe") returned 12
	[0084.912] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0084.913] lstrlenW (lpString="VSSVC.exe") returned 9
	[0084.913] Process32NextW (in: hSnapshot=0x208, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0084.913] CloseHandle (hObject=0x208) returned 1
	[0084.914] Sleep (dwMilliseconds=0x1f4) 
	[0085.426] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0085.427] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0085.427] GetLastError () returned 0xea
	[0085.428] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12c6) returned 0x32e7b0
	[0085.428] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0085.429] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0085.429] lstrlenW (lpString="Appinfo") returned 7
	[0085.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0085.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0085.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0085.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0085.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0085.430] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0085.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0085.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0085.431] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0085.431] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0085.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0085.431] lstrlenW (lpString="AudioSrv") returned 8
	[0085.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0085.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0085.431] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0085.432] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0085.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0085.432] lstrlenW (lpString="BFE") returned 3
	[0085.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0085.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0085.432] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0085.432] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0085.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0085.433] lstrlenW (lpString="CryptSvc") returned 8
	[0085.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0085.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0085.433] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0085.433] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0085.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0085.433] lstrlenW (lpString="CscService") returned 10
	[0085.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0085.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0085.434] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0085.434] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0085.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0085.434] lstrlenW (lpString="DcomLaunch") returned 10
	[0085.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0085.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0085.435] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0085.435] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0085.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0085.435] lstrlenW (lpString="Dhcp") returned 4
	[0085.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0085.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0085.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0085.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0085.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0085.436] lstrlenW (lpString="Dnscache") returned 8
	[0085.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0085.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0085.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0085.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0085.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0085.436] lstrlenW (lpString="DPS") returned 3
	[0085.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0085.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0085.437] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0085.437] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0085.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0085.437] lstrlenW (lpString="eventlog") returned 8
	[0085.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0085.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0085.438] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0085.438] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0085.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0085.438] lstrlenW (lpString="EventSystem") returned 11
	[0085.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0085.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0085.438] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0085.438] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0085.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0085.439] lstrlenW (lpString="gpsvc") returned 5
	[0085.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0085.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0085.439] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0085.439] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0085.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0085.439] lstrlenW (lpString="iphlpsvc") returned 8
	[0085.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0085.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0085.440] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0085.440] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0085.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0085.440] lstrlenW (lpString="LanmanServer") returned 12
	[0085.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0085.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0085.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0085.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0085.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0085.441] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0085.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0085.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0085.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0085.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0085.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0085.441] lstrlenW (lpString="lmhosts") returned 7
	[0085.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0085.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0085.442] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0085.442] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0085.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0085.442] lstrlenW (lpString="MMCSS") returned 5
	[0085.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0085.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0085.443] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0085.443] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0085.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0085.443] lstrlenW (lpString="MpsSvc") returned 6
	[0085.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0085.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0085.443] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0085.443] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0085.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0085.443] lstrlenW (lpString="Netman") returned 6
	[0085.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0085.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0085.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0085.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0085.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0085.444] lstrlenW (lpString="netprofm") returned 8
	[0085.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0085.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0085.444] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0085.445] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0085.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0085.445] lstrlenW (lpString="NlaSvc") returned 6
	[0085.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0085.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0085.445] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0085.445] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0085.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0085.446] lstrlenW (lpString="nsi") returned 3
	[0085.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0085.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0085.446] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0085.446] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0085.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0085.446] lstrlenW (lpString="PcaSvc") returned 6
	[0085.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0085.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0085.446] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0085.447] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0085.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0085.447] lstrlenW (lpString="PlugPlay") returned 8
	[0085.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0085.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0085.447] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0085.447] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0085.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0085.447] lstrlenW (lpString="Power") returned 5
	[0085.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0085.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0085.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0085.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0085.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0085.448] lstrlenW (lpString="ProfSvc") returned 7
	[0085.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0085.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0085.448] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0085.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0085.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0085.449] lstrlenW (lpString="RpcEptMapper") returned 12
	[0085.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0085.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0085.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0085.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0085.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0085.449] lstrlenW (lpString="RpcSs") returned 5
	[0085.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0085.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0085.450] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0085.450] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0085.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0085.450] lstrlenW (lpString="SamSs") returned 5
	[0085.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0085.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0085.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0085.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0085.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0085.451] lstrlenW (lpString="Schedule") returned 8
	[0085.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0085.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0085.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0085.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0085.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0085.451] lstrlenW (lpString="SENS") returned 4
	[0085.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0085.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0085.452] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0085.452] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0085.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0085.452] lstrlenW (lpString="ShellHWDetection") returned 16
	[0085.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0085.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0085.452] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0085.452] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0085.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0085.452] lstrlenW (lpString="Spooler") returned 7
	[0085.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0085.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0085.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0085.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0085.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0085.453] lstrlenW (lpString="swprv") returned 5
	[0085.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0085.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0085.453] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0085.454] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0085.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0085.454] lstrlenW (lpString="SysMain") returned 7
	[0085.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0085.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0085.454] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0085.454] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0085.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0085.454] lstrlenW (lpString="Themes") returned 6
	[0085.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0085.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0085.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0085.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0085.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0085.455] lstrlenW (lpString="TrkWks") returned 6
	[0085.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0085.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0085.455] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0085.456] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0085.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0085.456] lstrlenW (lpString="UxSms") returned 5
	[0085.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0085.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0085.456] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0085.456] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0085.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0085.456] lstrlenW (lpString="VSS") returned 3
	[0085.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0085.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0085.457] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0085.457] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0085.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0085.458] lstrlenW (lpString="WdiServiceHost") returned 14
	[0085.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0085.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0085.458] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0085.458] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0085.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0085.458] lstrlenW (lpString="WdiSystemHost") returned 13
	[0085.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0085.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0085.459] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0085.459] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0085.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0085.461] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0085.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.461] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.461] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0085.462] lstrlenW (lpString="Winmgmt") returned 7
	[0085.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0085.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0085.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0085.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0085.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0085.462] lstrlenW (lpString="WPDBusEnum") returned 10
	[0085.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0085.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0085.463] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0085.463] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0085.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0085.463] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0085.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0
	[0085.469] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0085.469] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0085.470] lstrlenW (lpString="System") returned 6
	[0085.470] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0085.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0085.470] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0085.470] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0085.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0085.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0085.471] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0085.471] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0085.471] lstrlenW (lpString="smss.exe") returned 8
	[0085.471] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0085.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0085.471] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0085.471] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0085.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0085.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0085.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0085.472] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0085.472] lstrlenW (lpString="csrss.exe") returned 9
	[0085.472] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0085.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0085.473] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0085.473] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0085.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0085.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0085.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0085.473] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0085.474] lstrlenW (lpString="wininit.exe") returned 11
	[0085.474] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0085.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0085.474] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0085.475] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0085.475] lstrlenW (lpString="csrss.exe") returned 9
	[0085.475] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0085.476] lstrlenW (lpString="winlogon.exe") returned 12
	[0085.476] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0085.476] lstrlenW (lpString="services.exe") returned 12
	[0085.477] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0085.477] lstrlenW (lpString="lsass.exe") returned 9
	[0085.477] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0085.478] lstrlenW (lpString="lsm.exe") returned 7
	[0085.478] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.478] lstrlenW (lpString="svchost.exe") returned 11
	[0085.478] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.479] lstrlenW (lpString="svchost.exe") returned 11
	[0085.479] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.480] lstrlenW (lpString="svchost.exe") returned 11
	[0085.480] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.481] lstrlenW (lpString="svchost.exe") returned 11
	[0085.481] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.481] lstrlenW (lpString="svchost.exe") returned 11
	[0085.481] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0085.482] lstrlenW (lpString="audiodg.exe") returned 11
	[0085.482] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.483] lstrlenW (lpString="svchost.exe") returned 11
	[0085.483] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.483] lstrlenW (lpString="svchost.exe") returned 11
	[0085.484] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0085.512] lstrlenW (lpString="dwm.exe") returned 7
	[0085.512] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0085.513] lstrlenW (lpString="explorer.exe") returned 12
	[0085.513] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0085.514] lstrlenW (lpString="spoolsv.exe") returned 11
	[0085.514] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.514] lstrlenW (lpString="svchost.exe") returned 11
	[0085.515] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0085.515] lstrlenW (lpString="taskhost.exe") returned 12
	[0085.515] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0085.516] lstrlenW (lpString="taskeng.exe") returned 11
	[0085.516] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0085.517] lstrlenW (lpString="elliott grace.exe") returned 17
	[0085.517] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0085.518] lstrlenW (lpString="floyd.exe") returned 9
	[0085.518] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0085.519] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0085.519] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0085.519] lstrlenW (lpString="bond.exe") returned 8
	[0085.520] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0085.520] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0085.521] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0085.521] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0085.521] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0085.522] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0085.522] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0085.523] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0085.523] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0085.523] lstrlenW (lpString="wheel_year.exe") returned 14
	[0085.523] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0085.524] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0085.524] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0085.525] lstrlenW (lpString="alifilm.exe") returned 11
	[0085.525] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0085.526] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0085.526] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0085.527] lstrlenW (lpString="orchestra.exe") returned 13
	[0085.527] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0085.528] lstrlenW (lpString="decade.exe") returned 10
	[0085.528] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0085.528] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0085.529] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0085.529] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0085.529] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0085.530] lstrlenW (lpString="bracket das.exe") returned 15
	[0085.530] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0085.531] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0085.531] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0085.532] lstrlenW (lpString="3dftp.exe") returned 9
	[0085.533] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0085.533] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0085.533] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0085.534] lstrlenW (lpString="alftp.exe") returned 9
	[0085.534] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0085.534] lstrlenW (lpString="barca.exe") returned 9
	[0085.535] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0085.535] lstrlenW (lpString="bitkinex.exe") returned 12
	[0085.536] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0085.536] lstrlenW (lpString="coreftp.exe") returned 11
	[0085.536] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0085.583] lstrlenW (lpString="far.exe") returned 7
	[0085.583] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0085.584] lstrlenW (lpString="filezilla.exe") returned 13
	[0085.584] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0085.584] lstrlenW (lpString="flashfxp.exe") returned 12
	[0085.585] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0085.585] lstrlenW (lpString="fling.exe") returned 9
	[0085.585] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0085.586] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0085.586] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0085.587] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0085.587] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0085.587] lstrlenW (lpString="icq.exe") returned 7
	[0085.588] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0085.588] lstrlenW (lpString="leechftp.exe") returned 12
	[0085.588] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0085.589] lstrlenW (lpString="ncftp.exe") returned 9
	[0085.589] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0085.590] lstrlenW (lpString="notepad.exe") returned 11
	[0085.590] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0085.591] lstrlenW (lpString="operamail.exe") returned 13
	[0085.591] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0085.591] lstrlenW (lpString="pidgin.exe") returned 10
	[0085.592] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0085.592] lstrlenW (lpString="scriptftp.exe") returned 13
	[0085.593] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0085.593] lstrlenW (lpString="skype.exe") returned 9
	[0085.594] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0085.594] lstrlenW (lpString="smartftp.exe") returned 12
	[0085.595] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0085.595] lstrlenW (lpString="thunderbird.exe") returned 15
	[0085.596] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0085.596] lstrlenW (lpString="totalcmd.exe") returned 12
	[0085.597] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0085.598] lstrlenW (lpString="trillian.exe") returned 12
	[0085.598] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0085.599] lstrlenW (lpString="webdrive.exe") returned 12
	[0085.599] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0085.600] lstrlenW (lpString="whatsapp.exe") returned 12
	[0085.600] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0085.601] lstrlenW (lpString="winscp.exe") returned 10
	[0085.601] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0085.602] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0085.602] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0085.603] lstrlenW (lpString="active-charge.exe") returned 17
	[0085.603] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0085.604] lstrlenW (lpString="accupos.exe") returned 11
	[0085.604] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0085.605] lstrlenW (lpString="afr38.exe") returned 9
	[0085.605] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0085.606] lstrlenW (lpString="aldelo.exe") returned 10
	[0085.606] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0085.607] lstrlenW (lpString="ccv_server.exe") returned 14
	[0085.607] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0085.608] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0085.608] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0085.651] lstrlenW (lpString="creditservice.exe") returned 17
	[0085.652] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0085.652] lstrlenW (lpString="edcsvr.exe") returned 10
	[0085.653] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0085.653] lstrlenW (lpString="fpos.exe") returned 8
	[0085.654] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0085.654] lstrlenW (lpString="isspos.exe") returned 10
	[0085.655] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0085.655] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0085.655] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0085.656] lstrlenW (lpString="omnipos.exe") returned 11
	[0085.656] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0085.657] lstrlenW (lpString="spcwin.exe") returned 10
	[0085.657] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0085.658] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0085.658] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0085.659] lstrlenW (lpString="utg2.exe") returned 8
	[0085.659] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0085.660] lstrlenW (lpString="interventions.exe") returned 17
	[0085.660] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0085.661] lstrlenW (lpString="hayes.exe") returned 9
	[0085.661] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0085.661] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0085.662] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0085.662] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0085.662] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0085.663] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0085.663] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0085.664] lstrlenW (lpString="taskhost.exe") returned 12
	[0085.664] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0085.664] lstrlenW (lpString="000005.exe") returned 10
	[0085.664] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0085.665] lstrlenW (lpString="cmd.exe") returned 7
	[0085.665] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0085.665] lstrlenW (lpString="conhost.exe") returned 11
	[0085.666] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0085.666] lstrlenW (lpString="vssadmin.exe") returned 12
	[0085.666] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0085.667] lstrlenW (lpString="VSSVC.exe") returned 9
	[0085.667] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.668] lstrlenW (lpString="svchost.exe") returned 11
	[0085.668] Process32NextW (in: hSnapshot=0x1e0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0085.668] CloseHandle (hObject=0x1e0) returned 1
	[0085.669] Sleep (dwMilliseconds=0x1f4) 
	[0086.216] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0086.217] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0086.217] GetLastError () returned 0xea
	[0086.217] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12c6) returned 0x32e7b0
	[0086.217] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0086.218] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0086.219] lstrlenW (lpString="Appinfo") returned 7
	[0086.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0086.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0086.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0086.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0086.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0086.220] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0086.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0086.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0086.220] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0086.220] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0086.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0086.220] lstrlenW (lpString="AudioSrv") returned 8
	[0086.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0086.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0086.221] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0086.221] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0086.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0086.221] lstrlenW (lpString="BFE") returned 3
	[0086.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0086.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0086.222] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0086.222] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0086.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0086.222] lstrlenW (lpString="CryptSvc") returned 8
	[0086.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0086.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0086.222] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0086.223] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0086.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0086.223] lstrlenW (lpString="CscService") returned 10
	[0086.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0086.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0086.223] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0086.223] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0086.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0086.223] lstrlenW (lpString="DcomLaunch") returned 10
	[0086.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0086.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0086.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0086.224] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0086.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0086.224] lstrlenW (lpString="Dhcp") returned 4
	[0086.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0086.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0086.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0086.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0086.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0086.225] lstrlenW (lpString="Dnscache") returned 8
	[0086.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0086.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0086.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0086.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0086.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0086.226] lstrlenW (lpString="DPS") returned 3
	[0086.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0086.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0086.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0086.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0086.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0086.226] lstrlenW (lpString="eventlog") returned 8
	[0086.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0086.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0086.227] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0086.227] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0086.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0086.227] lstrlenW (lpString="EventSystem") returned 11
	[0086.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0086.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0086.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0086.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0086.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0086.228] lstrlenW (lpString="gpsvc") returned 5
	[0086.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0086.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0086.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0086.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0086.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0086.228] lstrlenW (lpString="iphlpsvc") returned 8
	[0086.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0086.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0086.229] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0086.229] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0086.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0086.229] lstrlenW (lpString="LanmanServer") returned 12
	[0086.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0086.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0086.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0086.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0086.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0086.229] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0086.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0086.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0086.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0086.230] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0086.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0086.230] lstrlenW (lpString="lmhosts") returned 7
	[0086.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0086.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0086.230] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0086.230] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0086.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0086.230] lstrlenW (lpString="MMCSS") returned 5
	[0086.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0086.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0086.230] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0086.231] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0086.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0086.231] lstrlenW (lpString="MpsSvc") returned 6
	[0086.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0086.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0086.231] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0086.231] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0086.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0086.231] lstrlenW (lpString="Netman") returned 6
	[0086.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0086.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0086.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0086.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0086.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0086.232] lstrlenW (lpString="netprofm") returned 8
	[0086.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0086.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0086.232] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0086.232] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0086.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0086.232] lstrlenW (lpString="NlaSvc") returned 6
	[0086.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0086.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0086.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0086.233] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0086.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0086.233] lstrlenW (lpString="nsi") returned 3
	[0086.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0086.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0086.233] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0086.233] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0086.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0086.233] lstrlenW (lpString="PcaSvc") returned 6
	[0086.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0086.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0086.234] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0086.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0086.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0086.234] lstrlenW (lpString="PlugPlay") returned 8
	[0086.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0086.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0086.234] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0086.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0086.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0086.234] lstrlenW (lpString="Power") returned 5
	[0086.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0086.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0086.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0086.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0086.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0086.235] lstrlenW (lpString="ProfSvc") returned 7
	[0086.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0086.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0086.235] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0086.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0086.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0086.235] lstrlenW (lpString="RpcEptMapper") returned 12
	[0086.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0086.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0086.236] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0086.236] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0086.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0086.236] lstrlenW (lpString="RpcSs") returned 5
	[0086.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0086.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0086.236] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0086.236] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0086.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0086.236] lstrlenW (lpString="SamSs") returned 5
	[0086.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0086.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0086.237] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0086.237] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0086.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0086.237] lstrlenW (lpString="Schedule") returned 8
	[0086.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0086.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0086.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0086.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0086.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0086.238] lstrlenW (lpString="SENS") returned 4
	[0086.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0086.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0086.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0086.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0086.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0086.239] lstrlenW (lpString="ShellHWDetection") returned 16
	[0086.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0086.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0086.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0086.239] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0086.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0086.239] lstrlenW (lpString="Spooler") returned 7
	[0086.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0086.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0086.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0086.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0086.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0086.240] lstrlenW (lpString="swprv") returned 5
	[0086.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0086.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0086.240] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0086.240] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0086.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0086.240] lstrlenW (lpString="SysMain") returned 7
	[0086.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0086.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0086.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0086.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0086.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0086.241] lstrlenW (lpString="Themes") returned 6
	[0086.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0086.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0086.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0086.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0086.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0086.241] lstrlenW (lpString="TrkWks") returned 6
	[0086.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0086.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0086.242] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0086.242] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0086.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0086.242] lstrlenW (lpString="UxSms") returned 5
	[0086.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0086.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0086.242] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0086.242] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0086.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0086.243] lstrlenW (lpString="VSS") returned 3
	[0086.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0086.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0086.243] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0086.243] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0086.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0086.243] lstrlenW (lpString="WdiServiceHost") returned 14
	[0086.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0086.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0086.243] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0086.243] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0086.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0086.244] lstrlenW (lpString="WdiSystemHost") returned 13
	[0086.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0086.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0086.244] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0086.244] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0086.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0086.244] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0086.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0086.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0086.244] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0086.245] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0086.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0086.245] lstrlenW (lpString="Winmgmt") returned 7
	[0086.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0086.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0086.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0086.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0086.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0086.245] lstrlenW (lpString="WPDBusEnum") returned 10
	[0086.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0086.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0086.245] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0086.246] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0086.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0086.246] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0086.246] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec
	[0086.251] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0086.252] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0086.252] lstrlenW (lpString="System") returned 6
	[0086.252] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0086.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0086.253] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0086.253] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0086.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0086.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0086.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0086.253] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0086.254] lstrlenW (lpString="smss.exe") returned 8
	[0086.254] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0086.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0086.254] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0086.254] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0086.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0086.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0086.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0086.445] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0086.446] lstrlenW (lpString="csrss.exe") returned 9
	[0086.446] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0086.446] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0086.446] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0086.446] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0086.447] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0086.447] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0086.447] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0086.447] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0086.448] lstrlenW (lpString="wininit.exe") returned 11
	[0086.448] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0086.448] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0086.448] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0086.448] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0086.449] lstrlenW (lpString="csrss.exe") returned 9
	[0086.449] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0086.449] lstrlenW (lpString="winlogon.exe") returned 12
	[0086.450] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0086.450] lstrlenW (lpString="services.exe") returned 12
	[0086.450] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0086.451] lstrlenW (lpString="lsass.exe") returned 9
	[0086.451] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0086.452] lstrlenW (lpString="lsm.exe") returned 7
	[0086.452] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.452] lstrlenW (lpString="svchost.exe") returned 11
	[0086.452] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.453] lstrlenW (lpString="svchost.exe") returned 11
	[0086.453] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.454] lstrlenW (lpString="svchost.exe") returned 11
	[0086.454] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.455] lstrlenW (lpString="svchost.exe") returned 11
	[0086.455] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.456] lstrlenW (lpString="svchost.exe") returned 11
	[0086.456] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0086.457] lstrlenW (lpString="audiodg.exe") returned 11
	[0086.457] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.457] lstrlenW (lpString="svchost.exe") returned 11
	[0086.458] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.458] lstrlenW (lpString="svchost.exe") returned 11
	[0086.458] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0086.459] lstrlenW (lpString="dwm.exe") returned 7
	[0086.459] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0086.460] lstrlenW (lpString="explorer.exe") returned 12
	[0086.460] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0086.460] lstrlenW (lpString="spoolsv.exe") returned 11
	[0086.461] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.461] lstrlenW (lpString="svchost.exe") returned 11
	[0086.461] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0086.462] lstrlenW (lpString="taskhost.exe") returned 12
	[0086.462] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0086.463] lstrlenW (lpString="taskeng.exe") returned 11
	[0086.463] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0086.464] lstrlenW (lpString="elliott grace.exe") returned 17
	[0086.464] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0086.464] lstrlenW (lpString="floyd.exe") returned 9
	[0086.465] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0086.465] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0086.465] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0086.466] lstrlenW (lpString="bond.exe") returned 8
	[0086.466] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0086.467] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0086.467] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0086.468] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0086.468] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0086.468] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0086.469] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0086.469] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0086.469] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0086.470] lstrlenW (lpString="wheel_year.exe") returned 14
	[0086.470] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0086.471] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0086.471] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0086.472] lstrlenW (lpString="alifilm.exe") returned 11
	[0086.472] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0086.473] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0086.473] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0086.473] lstrlenW (lpString="orchestra.exe") returned 13
	[0086.473] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0086.474] lstrlenW (lpString="decade.exe") returned 10
	[0086.474] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0086.475] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0086.475] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0086.475] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0086.476] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0086.476] lstrlenW (lpString="bracket das.exe") returned 15
	[0086.476] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0086.477] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0086.477] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0086.478] lstrlenW (lpString="3dftp.exe") returned 9
	[0086.478] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0086.478] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0086.478] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0086.479] lstrlenW (lpString="alftp.exe") returned 9
	[0086.479] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0086.480] lstrlenW (lpString="barca.exe") returned 9
	[0086.480] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0086.480] lstrlenW (lpString="bitkinex.exe") returned 12
	[0086.480] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0086.481] lstrlenW (lpString="coreftp.exe") returned 11
	[0086.481] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0086.481] lstrlenW (lpString="far.exe") returned 7
	[0086.482] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0086.552] lstrlenW (lpString="filezilla.exe") returned 13
	[0086.552] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0086.553] lstrlenW (lpString="flashfxp.exe") returned 12
	[0086.553] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0086.554] lstrlenW (lpString="fling.exe") returned 9
	[0086.554] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0086.554] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0086.555] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0086.555] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0086.555] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0086.556] lstrlenW (lpString="icq.exe") returned 7
	[0086.556] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0086.557] lstrlenW (lpString="leechftp.exe") returned 12
	[0086.557] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0086.558] lstrlenW (lpString="ncftp.exe") returned 9
	[0086.558] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0086.558] lstrlenW (lpString="notepad.exe") returned 11
	[0086.559] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0086.559] lstrlenW (lpString="operamail.exe") returned 13
	[0086.560] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0086.560] lstrlenW (lpString="pidgin.exe") returned 10
	[0086.561] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0086.561] lstrlenW (lpString="scriptftp.exe") returned 13
	[0086.562] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0086.565] lstrlenW (lpString="skype.exe") returned 9
	[0086.565] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0086.566] lstrlenW (lpString="smartftp.exe") returned 12
	[0086.566] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0086.567] lstrlenW (lpString="thunderbird.exe") returned 15
	[0086.567] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0086.568] lstrlenW (lpString="totalcmd.exe") returned 12
	[0086.568] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0086.569] lstrlenW (lpString="trillian.exe") returned 12
	[0086.569] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0086.570] lstrlenW (lpString="webdrive.exe") returned 12
	[0086.570] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0086.571] lstrlenW (lpString="whatsapp.exe") returned 12
	[0086.571] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0086.572] lstrlenW (lpString="winscp.exe") returned 10
	[0086.572] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0086.573] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0086.573] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0086.574] lstrlenW (lpString="active-charge.exe") returned 17
	[0086.574] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0086.575] lstrlenW (lpString="accupos.exe") returned 11
	[0086.575] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0086.576] lstrlenW (lpString="afr38.exe") returned 9
	[0086.576] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0086.579] lstrlenW (lpString="aldelo.exe") returned 10
	[0086.580] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0086.581] lstrlenW (lpString="ccv_server.exe") returned 14
	[0086.581] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0086.581] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0086.582] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0086.582] lstrlenW (lpString="creditservice.exe") returned 17
	[0086.582] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0086.583] lstrlenW (lpString="edcsvr.exe") returned 10
	[0086.583] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0086.584] lstrlenW (lpString="fpos.exe") returned 8
	[0086.584] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0086.585] lstrlenW (lpString="isspos.exe") returned 10
	[0086.585] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0086.585] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0086.585] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0086.586] lstrlenW (lpString="omnipos.exe") returned 11
	[0086.586] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0086.829] lstrlenW (lpString="spcwin.exe") returned 10
	[0086.829] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0086.830] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0086.830] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0086.831] lstrlenW (lpString="utg2.exe") returned 8
	[0086.831] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0086.832] lstrlenW (lpString="interventions.exe") returned 17
	[0086.832] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0086.833] lstrlenW (lpString="hayes.exe") returned 9
	[0086.833] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0086.834] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0086.834] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0086.834] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0086.835] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0086.835] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0086.835] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0086.836] lstrlenW (lpString="taskhost.exe") returned 12
	[0086.836] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0086.837] lstrlenW (lpString="000005.exe") returned 10
	[0086.837] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0086.837] lstrlenW (lpString="cmd.exe") returned 7
	[0086.838] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.838] lstrlenW (lpString="conhost.exe") returned 11
	[0086.838] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0086.839] lstrlenW (lpString="vssadmin.exe") returned 12
	[0086.839] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0086.840] lstrlenW (lpString="VSSVC.exe") returned 9
	[0086.840] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.841] lstrlenW (lpString="svchost.exe") returned 11
	[0086.841] Process32NextW (in: hSnapshot=0x1ec, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0086.841] CloseHandle (hObject=0x1ec) returned 1
	[0086.841] Sleep (dwMilliseconds=0x1f4) 
	[0089.451] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0089.452] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0089.453] GetLastError () returned 0xea
	[0089.453] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12c6) returned 0x32e8f8
	[0089.453] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e8f8, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e8f8, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0089.454] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0089.455] lstrlenW (lpString="Appinfo") returned 7
	[0089.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0089.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0089.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0089.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0089.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0089.455] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0089.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0089.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0089.456] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0089.456] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0089.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0089.456] lstrlenW (lpString="AudioSrv") returned 8
	[0089.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0089.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0089.457] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0089.457] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0089.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0089.457] lstrlenW (lpString="BFE") returned 3
	[0089.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0089.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0089.457] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0089.458] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0089.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0089.458] lstrlenW (lpString="CryptSvc") returned 8
	[0089.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0089.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0089.458] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0089.458] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0089.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0089.459] lstrlenW (lpString="CscService") returned 10
	[0089.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0089.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0089.459] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0089.459] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0089.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0089.459] lstrlenW (lpString="DcomLaunch") returned 10
	[0089.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0089.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0089.460] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0089.460] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0089.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0089.460] lstrlenW (lpString="Dhcp") returned 4
	[0089.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0089.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0089.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0089.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0089.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0089.461] lstrlenW (lpString="Dnscache") returned 8
	[0089.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0089.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0089.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0089.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0089.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0089.461] lstrlenW (lpString="DPS") returned 3
	[0089.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0089.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0089.462] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0089.462] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0089.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0089.462] lstrlenW (lpString="eventlog") returned 8
	[0089.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0089.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0089.463] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0089.463] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0089.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0089.463] lstrlenW (lpString="EventSystem") returned 11
	[0089.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0089.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0089.463] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0089.463] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0089.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0089.464] lstrlenW (lpString="gpsvc") returned 5
	[0089.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0089.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0089.464] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0089.464] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0089.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0089.465] lstrlenW (lpString="iphlpsvc") returned 8
	[0089.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0089.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0089.465] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0089.465] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0089.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0089.465] lstrlenW (lpString="LanmanServer") returned 12
	[0089.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0089.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0089.466] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0089.466] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0089.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0089.466] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0089.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0089.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0089.466] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0089.467] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0089.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0089.467] lstrlenW (lpString="lmhosts") returned 7
	[0089.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0089.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0089.468] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0089.468] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0089.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0089.468] lstrlenW (lpString="MMCSS") returned 5
	[0089.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0089.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0089.468] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0089.468] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0089.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0089.469] lstrlenW (lpString="MpsSvc") returned 6
	[0089.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0089.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0089.469] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0089.469] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0089.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0089.469] lstrlenW (lpString="Netman") returned 6
	[0089.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0089.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0089.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0089.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0089.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0089.470] lstrlenW (lpString="netprofm") returned 8
	[0089.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0089.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0089.470] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0089.470] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0089.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0089.471] lstrlenW (lpString="NlaSvc") returned 6
	[0089.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0089.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0089.471] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0089.471] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0089.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0089.472] lstrlenW (lpString="nsi") returned 3
	[0089.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0089.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0089.472] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0089.473] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0089.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0089.473] lstrlenW (lpString="PcaSvc") returned 6
	[0089.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0089.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0089.473] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0089.473] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0089.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0089.473] lstrlenW (lpString="PlugPlay") returned 8
	[0089.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0089.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0089.474] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0089.474] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0089.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0089.474] lstrlenW (lpString="Power") returned 5
	[0089.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0089.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0089.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0089.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0089.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0089.475] lstrlenW (lpString="ProfSvc") returned 7
	[0089.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0089.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0089.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0089.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0089.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0089.475] lstrlenW (lpString="RpcEptMapper") returned 12
	[0089.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0089.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0089.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0089.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0089.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0089.476] lstrlenW (lpString="RpcSs") returned 5
	[0089.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0089.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0089.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0089.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0089.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0089.476] lstrlenW (lpString="SamSs") returned 5
	[0089.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0089.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0089.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0089.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0089.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0089.477] lstrlenW (lpString="Schedule") returned 8
	[0089.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0089.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0089.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0089.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0089.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0089.478] lstrlenW (lpString="SENS") returned 4
	[0089.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0089.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0089.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0089.478] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0089.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0089.478] lstrlenW (lpString="ShellHWDetection") returned 16
	[0089.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0089.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0089.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0089.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0089.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0089.479] lstrlenW (lpString="Spooler") returned 7
	[0089.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0089.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0089.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0089.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0089.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0089.480] lstrlenW (lpString="swprv") returned 5
	[0089.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0089.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0089.480] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0089.480] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0089.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0089.480] lstrlenW (lpString="SysMain") returned 7
	[0089.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0089.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0089.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0089.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0089.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0089.481] lstrlenW (lpString="Themes") returned 6
	[0089.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0089.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0089.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0089.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0089.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0089.482] lstrlenW (lpString="TrkWks") returned 6
	[0089.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0089.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0089.482] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0089.482] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0089.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0089.483] lstrlenW (lpString="UxSms") returned 5
	[0089.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0089.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0089.483] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0089.483] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0089.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0089.483] lstrlenW (lpString="VSS") returned 3
	[0089.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0089.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0089.484] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0089.484] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0089.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0089.484] lstrlenW (lpString="WdiServiceHost") returned 14
	[0089.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0089.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0089.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0089.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0089.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0089.484] lstrlenW (lpString="WdiSystemHost") returned 13
	[0089.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0089.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0089.485] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0089.485] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0089.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0089.485] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0089.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.485] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.485] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0089.485] lstrlenW (lpString="Winmgmt") returned 7
	[0089.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0089.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0089.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0089.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0089.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0089.486] lstrlenW (lpString="WPDBusEnum") returned 10
	[0089.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0089.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0089.486] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0089.486] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0089.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0089.487] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e8f8 | out: hHeap=0x2e0000) returned 1
	[0089.487] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8
	[0089.492] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0089.497] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0089.498] lstrlenW (lpString="System") returned 6
	[0089.498] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0089.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0089.498] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0089.498] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0089.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0089.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0089.498] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0089.498] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0089.499] lstrlenW (lpString="smss.exe") returned 8
	[0089.499] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0089.499] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0089.499] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0089.499] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0089.500] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0089.500] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0089.500] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0089.500] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0089.501] lstrlenW (lpString="csrss.exe") returned 9
	[0089.501] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0089.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0089.501] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0089.501] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0089.501] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0089.501] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0089.502] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0089.502] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0089.502] lstrlenW (lpString="wininit.exe") returned 11
	[0089.502] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0089.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0089.502] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0089.503] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0089.503] lstrlenW (lpString="csrss.exe") returned 9
	[0089.504] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0089.505] lstrlenW (lpString="winlogon.exe") returned 12
	[0089.505] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0089.505] lstrlenW (lpString="services.exe") returned 12
	[0089.506] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0089.506] lstrlenW (lpString="lsass.exe") returned 9
	[0089.506] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0089.507] lstrlenW (lpString="lsm.exe") returned 7
	[0089.507] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.507] lstrlenW (lpString="svchost.exe") returned 11
	[0089.508] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.508] lstrlenW (lpString="svchost.exe") returned 11
	[0089.508] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.509] lstrlenW (lpString="svchost.exe") returned 11
	[0089.509] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.509] lstrlenW (lpString="svchost.exe") returned 11
	[0089.510] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.510] lstrlenW (lpString="svchost.exe") returned 11
	[0089.510] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0089.511] lstrlenW (lpString="audiodg.exe") returned 11
	[0089.511] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.511] lstrlenW (lpString="svchost.exe") returned 11
	[0089.511] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.512] lstrlenW (lpString="svchost.exe") returned 11
	[0089.512] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0089.512] lstrlenW (lpString="dwm.exe") returned 7
	[0089.513] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0089.514] lstrlenW (lpString="explorer.exe") returned 12
	[0089.514] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0089.514] lstrlenW (lpString="spoolsv.exe") returned 11
	[0089.514] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.515] lstrlenW (lpString="svchost.exe") returned 11
	[0089.515] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0089.516] lstrlenW (lpString="taskhost.exe") returned 12
	[0089.516] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0089.516] lstrlenW (lpString="taskeng.exe") returned 11
	[0089.516] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0089.517] lstrlenW (lpString="elliott grace.exe") returned 17
	[0089.517] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0089.518] lstrlenW (lpString="floyd.exe") returned 9
	[0089.518] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0089.520] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0089.520] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0089.521] lstrlenW (lpString="bond.exe") returned 8
	[0089.522] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0089.522] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0089.522] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0089.523] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0089.523] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0089.523] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0089.523] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0089.524] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0089.524] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0089.525] lstrlenW (lpString="wheel_year.exe") returned 14
	[0089.525] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0089.525] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0089.525] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0089.526] lstrlenW (lpString="alifilm.exe") returned 11
	[0089.527] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0089.527] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0089.527] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0089.528] lstrlenW (lpString="orchestra.exe") returned 13
	[0089.528] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0089.531] lstrlenW (lpString="decade.exe") returned 10
	[0089.531] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0089.532] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0089.532] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0089.533] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0089.533] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0089.534] lstrlenW (lpString="bracket das.exe") returned 15
	[0089.534] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0089.534] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0089.534] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0089.535] lstrlenW (lpString="3dftp.exe") returned 9
	[0089.535] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0089.536] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0089.536] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0089.537] lstrlenW (lpString="alftp.exe") returned 9
	[0089.537] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0089.545] lstrlenW (lpString="barca.exe") returned 9
	[0089.547] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0089.547] lstrlenW (lpString="bitkinex.exe") returned 12
	[0089.547] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0089.548] lstrlenW (lpString="coreftp.exe") returned 11
	[0089.548] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0089.549] lstrlenW (lpString="far.exe") returned 7
	[0089.549] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0089.550] lstrlenW (lpString="filezilla.exe") returned 13
	[0089.550] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0089.551] lstrlenW (lpString="flashfxp.exe") returned 12
	[0089.551] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0089.552] lstrlenW (lpString="fling.exe") returned 9
	[0089.552] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0089.552] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0089.553] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0089.554] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0089.554] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0089.555] lstrlenW (lpString="icq.exe") returned 7
	[0089.555] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0089.556] lstrlenW (lpString="leechftp.exe") returned 12
	[0089.556] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0089.556] lstrlenW (lpString="ncftp.exe") returned 9
	[0089.557] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0089.558] lstrlenW (lpString="notepad.exe") returned 11
	[0089.558] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0089.560] lstrlenW (lpString="operamail.exe") returned 13
	[0089.560] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0089.561] lstrlenW (lpString="pidgin.exe") returned 10
	[0089.561] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0089.562] lstrlenW (lpString="scriptftp.exe") returned 13
	[0089.562] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0089.563] lstrlenW (lpString="skype.exe") returned 9
	[0089.563] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0089.564] lstrlenW (lpString="smartftp.exe") returned 12
	[0089.564] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0089.565] lstrlenW (lpString="thunderbird.exe") returned 15
	[0089.566] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0089.566] lstrlenW (lpString="totalcmd.exe") returned 12
	[0089.566] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0089.567] lstrlenW (lpString="trillian.exe") returned 12
	[0089.567] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0089.568] lstrlenW (lpString="webdrive.exe") returned 12
	[0089.568] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0089.569] lstrlenW (lpString="whatsapp.exe") returned 12
	[0089.569] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0089.570] lstrlenW (lpString="winscp.exe") returned 10
	[0089.570] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0089.571] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0089.571] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0089.572] lstrlenW (lpString="active-charge.exe") returned 17
	[0089.572] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0089.573] lstrlenW (lpString="accupos.exe") returned 11
	[0089.573] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0089.574] lstrlenW (lpString="afr38.exe") returned 9
	[0089.574] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0089.575] lstrlenW (lpString="aldelo.exe") returned 10
	[0089.575] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0089.576] lstrlenW (lpString="ccv_server.exe") returned 14
	[0089.576] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0089.577] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0089.577] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0089.578] lstrlenW (lpString="creditservice.exe") returned 17
	[0089.578] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0089.579] lstrlenW (lpString="edcsvr.exe") returned 10
	[0089.579] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0089.579] lstrlenW (lpString="fpos.exe") returned 8
	[0089.580] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0089.580] lstrlenW (lpString="isspos.exe") returned 10
	[0089.580] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0089.581] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0089.581] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0089.584] lstrlenW (lpString="omnipos.exe") returned 11
	[0089.585] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0089.585] lstrlenW (lpString="spcwin.exe") returned 10
	[0089.585] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0089.586] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0089.586] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0089.587] lstrlenW (lpString="utg2.exe") returned 8
	[0089.587] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0089.588] lstrlenW (lpString="interventions.exe") returned 17
	[0089.588] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0089.589] lstrlenW (lpString="hayes.exe") returned 9
	[0089.589] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0089.590] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0089.590] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0089.590] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0089.590] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0089.591] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0089.591] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0089.592] lstrlenW (lpString="taskhost.exe") returned 12
	[0089.592] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0089.593] lstrlenW (lpString="000005.exe") returned 10
	[0089.593] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0089.594] lstrlenW (lpString="cmd.exe") returned 7
	[0089.594] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0089.594] lstrlenW (lpString="conhost.exe") returned 11
	[0089.595] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0089.595] lstrlenW (lpString="vssadmin.exe") returned 12
	[0089.595] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0089.596] lstrlenW (lpString="VSSVC.exe") returned 9
	[0089.596] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0089.597] lstrlenW (lpString="svchost.exe") returned 11
	[0089.597] Process32NextW (in: hSnapshot=0x1c8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0089.597] CloseHandle (hObject=0x1c8) returned 1
	[0089.598] Sleep (dwMilliseconds=0x1f4) 
	[0090.130] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0090.130] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0090.131] GetLastError () returned 0xea
	[0090.131] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x133c) returned 0x32ee38
	[0090.131] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32ee38, cbBufSize=0x133c, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32ee38, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0090.132] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0090.132] lstrlenW (lpString="Appinfo") returned 7
	[0090.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0090.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0090.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0090.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0090.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0090.133] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0090.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0090.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0090.134] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0090.134] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0090.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0090.134] lstrlenW (lpString="AudioSrv") returned 8
	[0090.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0090.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0090.135] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0090.135] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0090.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0090.135] lstrlenW (lpString="BFE") returned 3
	[0090.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0090.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0090.135] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0090.135] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0090.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0090.136] lstrlenW (lpString="CryptSvc") returned 8
	[0090.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0090.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0090.136] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0090.136] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0090.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0090.137] lstrlenW (lpString="CscService") returned 10
	[0090.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0090.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0090.137] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0090.138] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0090.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0090.138] lstrlenW (lpString="DcomLaunch") returned 10
	[0090.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0090.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0090.138] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0090.138] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0090.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0090.139] lstrlenW (lpString="Dhcp") returned 4
	[0090.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0090.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0090.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0090.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0090.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0090.139] lstrlenW (lpString="Dnscache") returned 8
	[0090.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0090.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0090.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0090.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0090.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0090.140] lstrlenW (lpString="DPS") returned 3
	[0090.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0090.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0090.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0090.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0090.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0090.141] lstrlenW (lpString="eventlog") returned 8
	[0090.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0090.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0090.141] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0090.142] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0090.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0090.142] lstrlenW (lpString="EventSystem") returned 11
	[0090.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0090.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0090.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0090.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0090.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0090.143] lstrlenW (lpString="FontCache") returned 9
	[0090.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0090.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0090.143] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0090.143] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0090.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0090.144] lstrlenW (lpString="gpsvc") returned 5
	[0090.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0090.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0090.144] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0090.144] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0090.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0090.144] lstrlenW (lpString="iphlpsvc") returned 8
	[0090.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0090.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0090.145] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0090.145] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0090.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0090.145] lstrlenW (lpString="LanmanServer") returned 12
	[0090.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0090.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0090.146] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0090.146] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0090.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0090.146] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0090.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0090.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0090.146] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0090.146] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0090.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0090.147] lstrlenW (lpString="lmhosts") returned 7
	[0090.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0090.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0090.147] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0090.147] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0090.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0090.147] lstrlenW (lpString="MMCSS") returned 5
	[0090.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0090.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0090.148] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0090.148] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0090.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0090.148] lstrlenW (lpString="MpsSvc") returned 6
	[0090.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0090.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0090.148] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0090.149] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0090.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0090.149] lstrlenW (lpString="Netman") returned 6
	[0090.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0090.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0090.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0090.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0090.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0090.149] lstrlenW (lpString="netprofm") returned 8
	[0090.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0090.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0090.150] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0090.150] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0090.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0090.150] lstrlenW (lpString="NlaSvc") returned 6
	[0090.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0090.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0090.151] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0090.151] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0090.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0090.151] lstrlenW (lpString="nsi") returned 3
	[0090.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0090.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0090.151] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0090.151] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0090.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0090.152] lstrlenW (lpString="PcaSvc") returned 6
	[0090.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0090.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0090.152] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0090.152] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0090.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0090.152] lstrlenW (lpString="PlugPlay") returned 8
	[0090.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0090.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0090.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0090.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0090.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0090.154] lstrlenW (lpString="Power") returned 5
	[0090.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0090.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0090.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0090.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0090.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0090.154] lstrlenW (lpString="ProfSvc") returned 7
	[0090.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0090.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0090.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0090.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0090.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0090.155] lstrlenW (lpString="RpcEptMapper") returned 12
	[0090.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0090.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0090.156] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0090.156] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0090.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0090.156] lstrlenW (lpString="RpcSs") returned 5
	[0090.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0090.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0090.156] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0090.156] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0090.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0090.157] lstrlenW (lpString="SamSs") returned 5
	[0090.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0090.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0090.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0090.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0090.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0090.158] lstrlenW (lpString="Schedule") returned 8
	[0090.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0090.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0090.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0090.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0090.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0090.158] lstrlenW (lpString="SENS") returned 4
	[0090.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0090.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0090.159] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0090.159] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0090.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0090.159] lstrlenW (lpString="ShellHWDetection") returned 16
	[0090.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0090.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0090.159] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0090.160] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0090.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0090.160] lstrlenW (lpString="Spooler") returned 7
	[0090.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0090.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0090.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0090.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0090.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0090.161] lstrlenW (lpString="swprv") returned 5
	[0090.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0090.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0090.161] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0090.161] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0090.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0090.161] lstrlenW (lpString="SysMain") returned 7
	[0090.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0090.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0090.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0090.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0090.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0090.162] lstrlenW (lpString="Themes") returned 6
	[0090.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0090.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0090.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0090.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0090.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0090.163] lstrlenW (lpString="TrkWks") returned 6
	[0090.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0090.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0090.163] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0090.163] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0090.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0090.163] lstrlenW (lpString="UxSms") returned 5
	[0090.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0090.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0090.164] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0090.164] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0090.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0090.164] lstrlenW (lpString="VSS") returned 3
	[0090.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0090.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0090.165] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0090.165] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0090.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0090.165] lstrlenW (lpString="WdiServiceHost") returned 14
	[0090.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0090.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0090.165] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0090.165] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0090.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0090.166] lstrlenW (lpString="WdiSystemHost") returned 13
	[0090.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0090.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0090.166] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0090.166] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0090.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0090.166] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0090.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.167] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.167] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0090.167] lstrlenW (lpString="Winmgmt") returned 7
	[0090.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0090.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0090.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0090.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0090.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0090.168] lstrlenW (lpString="WPDBusEnum") returned 10
	[0090.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0090.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0090.218] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0090.218] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0090.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0090.218] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32ee38 | out: hHeap=0x2e0000) returned 1
	[0090.218] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200
	[0090.224] Process32FirstW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0090.225] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0090.225] lstrlenW (lpString="System") returned 6
	[0090.226] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0090.226] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0090.226] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0090.226] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0090.226] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0090.226] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0090.226] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0090.226] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0090.227] lstrlenW (lpString="smss.exe") returned 8
	[0090.227] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0090.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0090.227] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0090.227] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0090.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0090.228] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0090.228] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0090.228] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0090.228] lstrlenW (lpString="csrss.exe") returned 9
	[0090.228] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0090.229] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0090.229] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0090.229] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0090.229] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0090.229] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0090.230] lstrlenW (lpString="wininit.exe") returned 11
	[0090.230] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0090.231] lstrlenW (lpString="csrss.exe") returned 9
	[0090.231] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0090.232] lstrlenW (lpString="winlogon.exe") returned 12
	[0090.232] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0090.233] lstrlenW (lpString="services.exe") returned 12
	[0090.233] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0090.233] lstrlenW (lpString="lsass.exe") returned 9
	[0090.234] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0090.234] lstrlenW (lpString="lsm.exe") returned 7
	[0090.234] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.235] lstrlenW (lpString="svchost.exe") returned 11
	[0090.235] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.236] lstrlenW (lpString="svchost.exe") returned 11
	[0090.236] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.236] lstrlenW (lpString="svchost.exe") returned 11
	[0090.236] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.237] lstrlenW (lpString="svchost.exe") returned 11
	[0090.237] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.238] lstrlenW (lpString="svchost.exe") returned 11
	[0090.238] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0090.238] lstrlenW (lpString="audiodg.exe") returned 11
	[0090.238] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.239] lstrlenW (lpString="svchost.exe") returned 11
	[0090.239] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.240] lstrlenW (lpString="svchost.exe") returned 11
	[0090.240] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0090.240] lstrlenW (lpString="dwm.exe") returned 7
	[0090.240] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0090.241] lstrlenW (lpString="explorer.exe") returned 12
	[0090.241] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0090.242] lstrlenW (lpString="spoolsv.exe") returned 11
	[0090.242] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.242] lstrlenW (lpString="svchost.exe") returned 11
	[0090.242] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0090.243] lstrlenW (lpString="taskhost.exe") returned 12
	[0090.243] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0090.244] lstrlenW (lpString="taskeng.exe") returned 11
	[0090.244] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0090.244] lstrlenW (lpString="elliott grace.exe") returned 17
	[0090.244] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0090.245] lstrlenW (lpString="floyd.exe") returned 9
	[0090.245] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0090.246] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0090.246] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0090.246] lstrlenW (lpString="bond.exe") returned 8
	[0090.246] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0090.247] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0090.247] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0090.248] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0090.248] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0090.248] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0090.248] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0090.249] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0090.249] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0090.250] lstrlenW (lpString="wheel_year.exe") returned 14
	[0090.250] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0090.251] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0090.251] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0090.251] lstrlenW (lpString="alifilm.exe") returned 11
	[0090.251] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0090.252] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0090.252] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0090.253] lstrlenW (lpString="orchestra.exe") returned 13
	[0090.253] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0090.253] lstrlenW (lpString="decade.exe") returned 10
	[0090.253] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0090.254] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0090.254] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0090.255] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0090.255] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0090.309] lstrlenW (lpString="bracket das.exe") returned 15
	[0090.309] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0090.310] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0090.310] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0090.311] lstrlenW (lpString="3dftp.exe") returned 9
	[0090.311] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0090.312] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0090.312] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0090.313] lstrlenW (lpString="alftp.exe") returned 9
	[0090.313] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0090.313] lstrlenW (lpString="barca.exe") returned 9
	[0090.314] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0090.314] lstrlenW (lpString="bitkinex.exe") returned 12
	[0090.315] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0090.315] lstrlenW (lpString="coreftp.exe") returned 11
	[0090.315] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0090.316] lstrlenW (lpString="far.exe") returned 7
	[0090.316] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0090.317] lstrlenW (lpString="filezilla.exe") returned 13
	[0090.317] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0090.318] lstrlenW (lpString="flashfxp.exe") returned 12
	[0090.318] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0090.319] lstrlenW (lpString="fling.exe") returned 9
	[0090.319] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0090.319] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0090.319] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0090.320] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0090.320] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0090.321] lstrlenW (lpString="icq.exe") returned 7
	[0090.321] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0090.322] lstrlenW (lpString="leechftp.exe") returned 12
	[0090.322] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0090.322] lstrlenW (lpString="ncftp.exe") returned 9
	[0090.323] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0090.323] lstrlenW (lpString="notepad.exe") returned 11
	[0090.323] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0090.325] lstrlenW (lpString="operamail.exe") returned 13
	[0090.325] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0090.326] lstrlenW (lpString="pidgin.exe") returned 10
	[0090.326] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0090.327] lstrlenW (lpString="scriptftp.exe") returned 13
	[0090.327] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0090.328] lstrlenW (lpString="skype.exe") returned 9
	[0090.328] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0090.329] lstrlenW (lpString="smartftp.exe") returned 12
	[0090.329] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0090.330] lstrlenW (lpString="thunderbird.exe") returned 15
	[0090.330] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0090.331] lstrlenW (lpString="totalcmd.exe") returned 12
	[0090.331] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0090.332] lstrlenW (lpString="trillian.exe") returned 12
	[0090.332] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0090.333] lstrlenW (lpString="webdrive.exe") returned 12
	[0090.333] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0090.335] lstrlenW (lpString="whatsapp.exe") returned 12
	[0090.335] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0090.336] lstrlenW (lpString="winscp.exe") returned 10
	[0090.336] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0090.337] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0090.337] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0090.338] lstrlenW (lpString="active-charge.exe") returned 17
	[0090.338] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0090.338] lstrlenW (lpString="accupos.exe") returned 11
	[0090.339] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0090.339] lstrlenW (lpString="afr38.exe") returned 9
	[0090.340] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0090.340] lstrlenW (lpString="aldelo.exe") returned 10
	[0090.341] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0090.341] lstrlenW (lpString="ccv_server.exe") returned 14
	[0090.341] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0090.342] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0090.342] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0090.388] lstrlenW (lpString="creditservice.exe") returned 17
	[0090.388] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0090.389] lstrlenW (lpString="edcsvr.exe") returned 10
	[0090.389] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0090.389] lstrlenW (lpString="fpos.exe") returned 8
	[0090.390] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0090.390] lstrlenW (lpString="isspos.exe") returned 10
	[0090.390] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0090.391] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0090.391] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0090.392] lstrlenW (lpString="omnipos.exe") returned 11
	[0090.392] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0090.393] lstrlenW (lpString="spcwin.exe") returned 10
	[0090.393] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0090.394] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0090.394] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0090.395] lstrlenW (lpString="utg2.exe") returned 8
	[0090.395] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0090.395] lstrlenW (lpString="interventions.exe") returned 17
	[0090.396] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0090.396] lstrlenW (lpString="hayes.exe") returned 9
	[0090.396] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0090.397] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0090.397] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0090.398] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0090.398] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0090.399] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0090.399] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0090.400] lstrlenW (lpString="taskhost.exe") returned 12
	[0090.400] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0090.401] lstrlenW (lpString="000005.exe") returned 10
	[0090.401] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0090.402] lstrlenW (lpString="cmd.exe") returned 7
	[0090.402] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0090.418] lstrlenW (lpString="conhost.exe") returned 11
	[0090.418] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0090.419] lstrlenW (lpString="vssadmin.exe") returned 12
	[0090.419] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0090.420] lstrlenW (lpString="VSSVC.exe") returned 9
	[0090.420] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.421] lstrlenW (lpString="svchost.exe") returned 11
	[0090.421] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0090.422] lstrlenW (lpString="svchost.exe") returned 11
	[0090.422] Process32NextW (in: hSnapshot=0x200, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0090.423] CloseHandle (hObject=0x200) returned 1
	[0090.423] Sleep (dwMilliseconds=0x1f4) 
	[0091.128] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0091.131] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0091.131] GetLastError () returned 0xea
	[0091.131] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12b4) returned 0x32f160
	[0091.132] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32f160, cbBufSize=0x12b4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32f160, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0091.133] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0091.133] lstrlenW (lpString="Appinfo") returned 7
	[0091.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0091.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0091.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0091.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0091.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0091.134] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0091.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0091.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0091.134] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0091.135] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0091.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0091.135] lstrlenW (lpString="AudioSrv") returned 8
	[0091.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0091.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0091.135] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0091.135] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0091.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0091.136] lstrlenW (lpString="BFE") returned 3
	[0091.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0091.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0091.136] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0091.136] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0091.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0091.136] lstrlenW (lpString="CryptSvc") returned 8
	[0091.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0091.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0091.137] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0091.137] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0091.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0091.137] lstrlenW (lpString="CscService") returned 10
	[0091.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0091.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0091.138] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0091.138] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0091.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0091.138] lstrlenW (lpString="DcomLaunch") returned 10
	[0091.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0091.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0091.138] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0091.138] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0091.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0091.139] lstrlenW (lpString="Dhcp") returned 4
	[0091.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0091.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0091.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0091.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0091.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0091.139] lstrlenW (lpString="Dnscache") returned 8
	[0091.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0091.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0091.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0091.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0091.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0091.140] lstrlenW (lpString="DPS") returned 3
	[0091.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0091.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0091.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0091.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0091.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0091.141] lstrlenW (lpString="eventlog") returned 8
	[0091.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0091.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0091.141] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0091.142] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0091.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0091.142] lstrlenW (lpString="EventSystem") returned 11
	[0091.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0091.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0091.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0091.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0091.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0091.143] lstrlenW (lpString="FontCache") returned 9
	[0091.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0091.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0091.143] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0091.143] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0091.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0091.143] lstrlenW (lpString="gpsvc") returned 5
	[0091.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0091.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0091.144] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0091.144] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0091.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0091.144] lstrlenW (lpString="iphlpsvc") returned 8
	[0091.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0091.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0091.145] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0091.145] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0091.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0091.145] lstrlenW (lpString="LanmanServer") returned 12
	[0091.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0091.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0091.146] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0091.146] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0091.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0091.146] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0091.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0091.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0091.146] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0091.147] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0091.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0091.147] lstrlenW (lpString="lmhosts") returned 7
	[0091.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0091.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0091.147] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0091.147] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0091.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0091.148] lstrlenW (lpString="MMCSS") returned 5
	[0091.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0091.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0091.148] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0091.148] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0091.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0091.149] lstrlenW (lpString="MpsSvc") returned 6
	[0091.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0091.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0091.149] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0091.149] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0091.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0091.149] lstrlenW (lpString="Netman") returned 6
	[0091.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0091.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0091.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0091.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0091.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0091.150] lstrlenW (lpString="netprofm") returned 8
	[0091.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0091.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0091.151] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0091.151] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0091.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0091.152] lstrlenW (lpString="NlaSvc") returned 6
	[0091.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0091.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0091.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0091.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0091.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0091.152] lstrlenW (lpString="nsi") returned 3
	[0091.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0091.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0091.153] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0091.153] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0091.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0091.153] lstrlenW (lpString="PcaSvc") returned 6
	[0091.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0091.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0091.154] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0091.154] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0091.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0091.154] lstrlenW (lpString="PlugPlay") returned 8
	[0091.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0091.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0091.155] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0091.155] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0091.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0091.155] lstrlenW (lpString="Power") returned 5
	[0091.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0091.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0091.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0091.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0091.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0091.156] lstrlenW (lpString="ProfSvc") returned 7
	[0091.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0091.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0091.157] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0091.157] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0091.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0091.157] lstrlenW (lpString="RpcEptMapper") returned 12
	[0091.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0091.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0091.158] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0091.158] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0091.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0091.158] lstrlenW (lpString="RpcSs") returned 5
	[0091.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0091.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0091.158] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0091.159] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0091.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0091.159] lstrlenW (lpString="SamSs") returned 5
	[0091.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0091.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0091.159] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0091.159] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0091.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0091.160] lstrlenW (lpString="Schedule") returned 8
	[0091.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0091.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0091.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0091.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0091.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0091.161] lstrlenW (lpString="SENS") returned 4
	[0091.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0091.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0091.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0091.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0091.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0091.161] lstrlenW (lpString="ShellHWDetection") returned 16
	[0091.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0091.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0091.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0091.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0091.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0091.162] lstrlenW (lpString="Spooler") returned 7
	[0091.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0091.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0091.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0091.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0091.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0091.163] lstrlenW (lpString="swprv") returned 5
	[0091.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0091.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0091.293] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0091.294] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0091.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0091.294] lstrlenW (lpString="SysMain") returned 7
	[0091.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0091.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0091.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0091.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0091.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0091.295] lstrlenW (lpString="Themes") returned 6
	[0091.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0091.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0091.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0091.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0091.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0091.295] lstrlenW (lpString="TrkWks") returned 6
	[0091.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0091.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0091.296] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0091.296] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0091.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0091.296] lstrlenW (lpString="UxSms") returned 5
	[0091.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0091.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0091.296] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0091.297] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0091.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0091.297] lstrlenW (lpString="VSS") returned 3
	[0091.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0091.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0091.297] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0091.297] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0091.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0091.298] lstrlenW (lpString="WdiServiceHost") returned 14
	[0091.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0091.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0091.298] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0091.298] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0091.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0091.298] lstrlenW (lpString="WdiSystemHost") returned 13
	[0091.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0091.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0091.299] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0091.299] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0091.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0091.299] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0091.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0091.300] lstrlenW (lpString="Winmgmt") returned 7
	[0091.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0091.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0091.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0091.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0091.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0091.301] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32f160 | out: hHeap=0x2e0000) returned 1
	[0091.301] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4
	[0091.307] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0091.308] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0091.309] lstrlenW (lpString="System") returned 6
	[0091.309] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0091.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0091.309] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0091.309] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0091.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0091.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0091.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0091.310] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0091.310] lstrlenW (lpString="smss.exe") returned 8
	[0091.311] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0091.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0091.311] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0091.311] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0091.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0091.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0091.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0091.311] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0091.312] lstrlenW (lpString="csrss.exe") returned 9
	[0091.312] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0091.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0091.312] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0091.313] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0091.313] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0091.313] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0091.313] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0091.313] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0091.313] lstrlenW (lpString="wininit.exe") returned 11
	[0091.314] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0091.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0091.314] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0091.314] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0091.315] lstrlenW (lpString="csrss.exe") returned 9
	[0091.315] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0091.315] lstrlenW (lpString="winlogon.exe") returned 12
	[0091.315] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0091.316] lstrlenW (lpString="services.exe") returned 12
	[0091.316] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0091.317] lstrlenW (lpString="lsass.exe") returned 9
	[0091.317] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0091.317] lstrlenW (lpString="lsm.exe") returned 7
	[0091.317] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.318] lstrlenW (lpString="svchost.exe") returned 11
	[0091.318] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.319] lstrlenW (lpString="svchost.exe") returned 11
	[0091.319] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.320] lstrlenW (lpString="svchost.exe") returned 11
	[0091.320] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.320] lstrlenW (lpString="svchost.exe") returned 11
	[0091.320] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.321] lstrlenW (lpString="svchost.exe") returned 11
	[0091.321] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0091.322] lstrlenW (lpString="audiodg.exe") returned 11
	[0091.322] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.323] lstrlenW (lpString="svchost.exe") returned 11
	[0091.323] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.324] lstrlenW (lpString="svchost.exe") returned 11
	[0091.324] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0091.324] lstrlenW (lpString="dwm.exe") returned 7
	[0091.325] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0091.325] lstrlenW (lpString="explorer.exe") returned 12
	[0091.325] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0091.326] lstrlenW (lpString="spoolsv.exe") returned 11
	[0091.326] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.327] lstrlenW (lpString="svchost.exe") returned 11
	[0091.327] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0091.328] lstrlenW (lpString="taskhost.exe") returned 12
	[0091.328] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0091.328] lstrlenW (lpString="taskeng.exe") returned 11
	[0091.329] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0091.432] lstrlenW (lpString="elliott grace.exe") returned 17
	[0091.433] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0091.433] lstrlenW (lpString="floyd.exe") returned 9
	[0091.434] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0091.434] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0091.434] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0091.435] lstrlenW (lpString="bond.exe") returned 8
	[0091.435] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0091.440] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0091.440] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0091.440] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0091.441] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0091.441] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0091.441] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0091.442] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0091.442] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0091.443] lstrlenW (lpString="wheel_year.exe") returned 14
	[0091.443] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0091.444] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0091.444] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0091.445] lstrlenW (lpString="alifilm.exe") returned 11
	[0091.445] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0091.446] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0091.446] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0091.446] lstrlenW (lpString="orchestra.exe") returned 13
	[0091.447] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0091.460] lstrlenW (lpString="decade.exe") returned 10
	[0091.460] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0091.461] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0091.461] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0091.462] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0091.462] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0091.463] lstrlenW (lpString="bracket das.exe") returned 15
	[0091.463] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0091.464] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0091.464] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0091.465] lstrlenW (lpString="3dftp.exe") returned 9
	[0091.465] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0091.466] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0091.466] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0091.467] lstrlenW (lpString="alftp.exe") returned 9
	[0091.467] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0091.467] lstrlenW (lpString="barca.exe") returned 9
	[0091.468] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0091.468] lstrlenW (lpString="bitkinex.exe") returned 12
	[0091.468] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0091.469] lstrlenW (lpString="coreftp.exe") returned 11
	[0091.469] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0091.470] lstrlenW (lpString="far.exe") returned 7
	[0091.470] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0091.471] lstrlenW (lpString="filezilla.exe") returned 13
	[0091.471] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0091.472] lstrlenW (lpString="flashfxp.exe") returned 12
	[0091.472] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0091.472] lstrlenW (lpString="fling.exe") returned 9
	[0091.473] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0091.474] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0091.474] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0091.475] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0091.475] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0091.475] lstrlenW (lpString="icq.exe") returned 7
	[0091.476] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0091.476] lstrlenW (lpString="leechftp.exe") returned 12
	[0091.476] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0091.477] lstrlenW (lpString="ncftp.exe") returned 9
	[0091.477] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0091.478] lstrlenW (lpString="notepad.exe") returned 11
	[0091.478] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0091.479] lstrlenW (lpString="operamail.exe") returned 13
	[0091.479] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0091.480] lstrlenW (lpString="pidgin.exe") returned 10
	[0091.480] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0091.481] lstrlenW (lpString="scriptftp.exe") returned 13
	[0091.481] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0091.526] lstrlenW (lpString="skype.exe") returned 9
	[0091.526] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0091.527] lstrlenW (lpString="smartftp.exe") returned 12
	[0091.527] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0091.528] lstrlenW (lpString="thunderbird.exe") returned 15
	[0091.528] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0091.528] lstrlenW (lpString="totalcmd.exe") returned 12
	[0091.528] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0091.529] lstrlenW (lpString="trillian.exe") returned 12
	[0091.529] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0091.530] lstrlenW (lpString="webdrive.exe") returned 12
	[0091.530] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0091.531] lstrlenW (lpString="whatsapp.exe") returned 12
	[0091.531] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0091.532] lstrlenW (lpString="winscp.exe") returned 10
	[0091.532] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0091.533] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0091.533] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0091.534] lstrlenW (lpString="active-charge.exe") returned 17
	[0091.534] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0091.534] lstrlenW (lpString="accupos.exe") returned 11
	[0091.535] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0091.535] lstrlenW (lpString="afr38.exe") returned 9
	[0091.536] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0091.536] lstrlenW (lpString="aldelo.exe") returned 10
	[0091.536] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0091.537] lstrlenW (lpString="ccv_server.exe") returned 14
	[0091.537] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0091.538] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0091.538] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0091.539] lstrlenW (lpString="creditservice.exe") returned 17
	[0091.539] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0091.539] lstrlenW (lpString="edcsvr.exe") returned 10
	[0091.540] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0091.540] lstrlenW (lpString="fpos.exe") returned 8
	[0091.540] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0091.541] lstrlenW (lpString="isspos.exe") returned 10
	[0091.542] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0091.543] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0091.543] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0091.543] lstrlenW (lpString="omnipos.exe") returned 11
	[0091.544] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0091.544] lstrlenW (lpString="spcwin.exe") returned 10
	[0091.544] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0091.545] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0091.545] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0091.546] lstrlenW (lpString="utg2.exe") returned 8
	[0091.546] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0091.547] lstrlenW (lpString="interventions.exe") returned 17
	[0091.547] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0091.548] lstrlenW (lpString="hayes.exe") returned 9
	[0091.548] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0091.549] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0091.549] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0091.550] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0091.550] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0091.550] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0091.550] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0091.551] lstrlenW (lpString="taskhost.exe") returned 12
	[0091.551] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0091.552] lstrlenW (lpString="000005.exe") returned 10
	[0091.552] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0091.552] lstrlenW (lpString="cmd.exe") returned 7
	[0091.553] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0091.553] lstrlenW (lpString="conhost.exe") returned 11
	[0091.553] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0091.554] lstrlenW (lpString="vssadmin.exe") returned 12
	[0091.554] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0091.555] lstrlenW (lpString="VSSVC.exe") returned 9
	[0091.555] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.555] lstrlenW (lpString="svchost.exe") returned 11
	[0091.555] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0091.556] lstrlenW (lpString="svchost.exe") returned 11
	[0091.556] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0091.557] CloseHandle (hObject=0x1f4) returned 1
	[0091.557] Sleep (dwMilliseconds=0x1f4) 
	[0092.493] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0092.495] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0092.495] GetLastError () returned 0xea
	[0092.495] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12b4) returned 0x32e8f8
	[0092.495] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e8f8, cbBufSize=0x12b4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e8f8, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0092.497] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0092.497] lstrlenW (lpString="Appinfo") returned 7
	[0092.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0092.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0092.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0092.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0092.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0092.498] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0092.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0092.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0092.498] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0092.498] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0092.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0092.498] lstrlenW (lpString="AudioSrv") returned 8
	[0092.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0092.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0092.499] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0092.499] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0092.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0092.499] lstrlenW (lpString="BFE") returned 3
	[0092.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0092.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0092.499] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0092.500] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0092.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0092.500] lstrlenW (lpString="CryptSvc") returned 8
	[0092.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0092.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0092.500] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0092.500] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0092.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0092.500] lstrlenW (lpString="CscService") returned 10
	[0092.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0092.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0092.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0092.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0092.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0092.501] lstrlenW (lpString="DcomLaunch") returned 10
	[0092.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0092.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0092.501] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0092.501] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0092.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0092.502] lstrlenW (lpString="Dhcp") returned 4
	[0092.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0092.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0092.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0092.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0092.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0092.502] lstrlenW (lpString="Dnscache") returned 8
	[0092.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0092.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0092.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0092.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0092.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0092.503] lstrlenW (lpString="DPS") returned 3
	[0092.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0092.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0092.503] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0092.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0092.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0092.503] lstrlenW (lpString="eventlog") returned 8
	[0092.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0092.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0092.504] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0092.504] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0092.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0092.504] lstrlenW (lpString="EventSystem") returned 11
	[0092.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0092.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0092.504] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0092.505] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0092.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0092.505] lstrlenW (lpString="FontCache") returned 9
	[0092.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0092.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0092.505] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0092.505] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0092.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0092.505] lstrlenW (lpString="gpsvc") returned 5
	[0092.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0092.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0092.506] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0092.506] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0092.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0092.506] lstrlenW (lpString="iphlpsvc") returned 8
	[0092.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0092.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0092.507] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0092.507] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0092.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0092.507] lstrlenW (lpString="LanmanServer") returned 12
	[0092.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0092.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0092.507] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0092.507] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0092.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0092.508] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0092.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0092.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0092.508] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0092.508] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0092.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0092.509] lstrlenW (lpString="lmhosts") returned 7
	[0092.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0092.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0092.509] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0092.509] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0092.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0092.509] lstrlenW (lpString="MMCSS") returned 5
	[0092.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0092.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0092.510] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0092.510] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0092.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0092.510] lstrlenW (lpString="MpsSvc") returned 6
	[0092.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0092.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0092.510] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0092.511] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0092.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0092.511] lstrlenW (lpString="Netman") returned 6
	[0092.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0092.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0092.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0092.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0092.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0092.512] lstrlenW (lpString="netprofm") returned 8
	[0092.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0092.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0092.512] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0092.512] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0092.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0092.512] lstrlenW (lpString="NlaSvc") returned 6
	[0092.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0092.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0092.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0092.513] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0092.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0092.513] lstrlenW (lpString="nsi") returned 3
	[0092.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0092.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0092.513] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0092.513] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0092.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0092.513] lstrlenW (lpString="PcaSvc") returned 6
	[0092.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0092.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0092.514] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0092.514] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0092.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0092.514] lstrlenW (lpString="PlugPlay") returned 8
	[0092.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0092.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0092.515] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0092.515] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0092.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0092.515] lstrlenW (lpString="Power") returned 5
	[0092.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0092.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0092.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0092.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0092.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0092.516] lstrlenW (lpString="ProfSvc") returned 7
	[0092.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0092.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0092.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0092.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0092.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0092.516] lstrlenW (lpString="RpcEptMapper") returned 12
	[0092.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0092.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0092.517] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0092.517] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0092.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0092.517] lstrlenW (lpString="RpcSs") returned 5
	[0092.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0092.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0092.517] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0092.517] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0092.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0092.518] lstrlenW (lpString="SamSs") returned 5
	[0092.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0092.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0092.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0092.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0092.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0092.518] lstrlenW (lpString="Schedule") returned 8
	[0092.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0092.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0092.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0092.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0092.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0092.519] lstrlenW (lpString="SENS") returned 4
	[0092.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0092.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0092.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0092.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0092.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0092.520] lstrlenW (lpString="ShellHWDetection") returned 16
	[0092.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0092.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0092.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0092.521] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0092.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0092.521] lstrlenW (lpString="Spooler") returned 7
	[0092.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0092.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0092.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0092.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0092.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0092.522] lstrlenW (lpString="swprv") returned 5
	[0092.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0092.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0092.522] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0092.522] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0092.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0092.522] lstrlenW (lpString="SysMain") returned 7
	[0092.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0092.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0092.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0092.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0092.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0092.523] lstrlenW (lpString="Themes") returned 6
	[0092.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0092.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0092.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0092.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0092.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0092.524] lstrlenW (lpString="TrkWks") returned 6
	[0092.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0092.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0092.525] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0092.525] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0092.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0092.525] lstrlenW (lpString="UxSms") returned 5
	[0092.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0092.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0092.526] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0092.526] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0092.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0092.526] lstrlenW (lpString="VSS") returned 3
	[0092.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0092.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0092.526] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0092.527] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0092.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0092.527] lstrlenW (lpString="WdiServiceHost") returned 14
	[0092.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0092.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0092.527] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0092.527] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0092.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0092.528] lstrlenW (lpString="WdiSystemHost") returned 13
	[0092.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0092.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0092.528] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0092.528] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0092.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0092.528] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0092.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0092.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0092.529] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0092.529] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0092.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0092.529] lstrlenW (lpString="Winmgmt") returned 7
	[0092.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0092.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0092.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0092.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0092.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0092.530] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e8f8 | out: hHeap=0x2e0000) returned 1
	[0092.530] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204
	[0092.537] Process32FirstW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0092.538] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0092.538] lstrlenW (lpString="System") returned 6
	[0092.538] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0092.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0092.539] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0092.539] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0092.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0092.539] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0092.539] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0092.539] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0092.540] lstrlenW (lpString="smss.exe") returned 8
	[0092.540] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0092.540] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0092.540] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0092.540] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0092.541] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0092.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0092.541] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0092.541] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0092.542] lstrlenW (lpString="csrss.exe") returned 9
	[0092.542] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0092.542] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0092.542] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0092.543] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0092.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0092.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0092.543] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0092.543] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0092.544] lstrlenW (lpString="wininit.exe") returned 11
	[0092.544] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0092.544] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0092.544] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0092.544] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0092.545] lstrlenW (lpString="csrss.exe") returned 9
	[0092.545] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0092.546] lstrlenW (lpString="winlogon.exe") returned 12
	[0092.546] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0092.546] lstrlenW (lpString="services.exe") returned 12
	[0092.547] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0092.547] lstrlenW (lpString="lsass.exe") returned 9
	[0092.548] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0092.548] lstrlenW (lpString="lsm.exe") returned 7
	[0092.548] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.549] lstrlenW (lpString="svchost.exe") returned 11
	[0092.549] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.549] lstrlenW (lpString="svchost.exe") returned 11
	[0092.550] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.550] lstrlenW (lpString="svchost.exe") returned 11
	[0092.550] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.551] lstrlenW (lpString="svchost.exe") returned 11
	[0092.551] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.551] lstrlenW (lpString="svchost.exe") returned 11
	[0092.552] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0092.552] lstrlenW (lpString="audiodg.exe") returned 11
	[0092.552] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.553] lstrlenW (lpString="svchost.exe") returned 11
	[0092.553] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.554] lstrlenW (lpString="svchost.exe") returned 11
	[0092.554] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0092.555] lstrlenW (lpString="dwm.exe") returned 7
	[0092.555] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0092.555] lstrlenW (lpString="explorer.exe") returned 12
	[0092.556] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0092.556] lstrlenW (lpString="spoolsv.exe") returned 11
	[0092.556] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.557] lstrlenW (lpString="svchost.exe") returned 11
	[0092.557] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0092.557] lstrlenW (lpString="taskhost.exe") returned 12
	[0092.557] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0092.558] lstrlenW (lpString="taskeng.exe") returned 11
	[0092.558] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0092.559] lstrlenW (lpString="elliott grace.exe") returned 17
	[0092.559] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0092.559] lstrlenW (lpString="floyd.exe") returned 9
	[0092.559] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0092.560] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0092.560] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0092.561] lstrlenW (lpString="bond.exe") returned 8
	[0092.561] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0092.562] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0092.562] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0092.562] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0092.563] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0092.563] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0092.563] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0092.564] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0092.564] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0092.564] lstrlenW (lpString="wheel_year.exe") returned 14
	[0092.564] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0092.565] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0092.565] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0092.566] lstrlenW (lpString="alifilm.exe") returned 11
	[0092.566] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0092.567] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0092.567] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0092.567] lstrlenW (lpString="orchestra.exe") returned 13
	[0092.567] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0092.568] lstrlenW (lpString="decade.exe") returned 10
	[0092.568] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0092.568] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0092.568] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0092.569] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0092.569] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0092.569] lstrlenW (lpString="bracket das.exe") returned 15
	[0092.570] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0092.570] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0092.570] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0092.571] lstrlenW (lpString="3dftp.exe") returned 9
	[0092.571] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0092.572] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0092.572] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0092.573] lstrlenW (lpString="alftp.exe") returned 9
	[0092.573] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0092.573] lstrlenW (lpString="barca.exe") returned 9
	[0092.573] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0092.574] lstrlenW (lpString="bitkinex.exe") returned 12
	[0092.574] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0092.574] lstrlenW (lpString="coreftp.exe") returned 11
	[0092.575] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0092.575] lstrlenW (lpString="far.exe") returned 7
	[0092.575] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0092.576] lstrlenW (lpString="filezilla.exe") returned 13
	[0092.576] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0092.576] lstrlenW (lpString="flashfxp.exe") returned 12
	[0092.577] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0092.577] lstrlenW (lpString="fling.exe") returned 9
	[0092.577] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0092.578] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0092.578] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0092.578] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0092.578] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0092.579] lstrlenW (lpString="icq.exe") returned 7
	[0092.579] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0092.580] lstrlenW (lpString="leechftp.exe") returned 12
	[0092.580] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0092.580] lstrlenW (lpString="ncftp.exe") returned 9
	[0092.580] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0092.581] lstrlenW (lpString="notepad.exe") returned 11
	[0092.581] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0092.582] lstrlenW (lpString="operamail.exe") returned 13
	[0092.582] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0092.583] lstrlenW (lpString="pidgin.exe") returned 10
	[0092.583] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0092.583] lstrlenW (lpString="scriptftp.exe") returned 13
	[0092.584] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0092.584] lstrlenW (lpString="skype.exe") returned 9
	[0092.584] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0092.585] lstrlenW (lpString="smartftp.exe") returned 12
	[0092.585] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0092.586] lstrlenW (lpString="thunderbird.exe") returned 15
	[0092.586] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0092.587] lstrlenW (lpString="totalcmd.exe") returned 12
	[0092.587] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0092.588] lstrlenW (lpString="trillian.exe") returned 12
	[0092.588] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0092.589] lstrlenW (lpString="webdrive.exe") returned 12
	[0092.589] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0092.590] lstrlenW (lpString="whatsapp.exe") returned 12
	[0092.590] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0092.591] lstrlenW (lpString="winscp.exe") returned 10
	[0092.591] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0092.592] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0092.592] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0092.593] lstrlenW (lpString="active-charge.exe") returned 17
	[0092.593] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0092.594] lstrlenW (lpString="accupos.exe") returned 11
	[0092.594] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0092.595] lstrlenW (lpString="afr38.exe") returned 9
	[0092.595] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0092.595] lstrlenW (lpString="aldelo.exe") returned 10
	[0092.596] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0092.596] lstrlenW (lpString="ccv_server.exe") returned 14
	[0092.596] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0092.597] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0092.597] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0092.598] lstrlenW (lpString="creditservice.exe") returned 17
	[0092.598] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0092.599] lstrlenW (lpString="edcsvr.exe") returned 10
	[0092.599] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0092.600] lstrlenW (lpString="fpos.exe") returned 8
	[0092.600] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0092.601] lstrlenW (lpString="isspos.exe") returned 10
	[0092.601] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0092.602] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0092.602] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0092.603] lstrlenW (lpString="omnipos.exe") returned 11
	[0092.603] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0092.604] lstrlenW (lpString="spcwin.exe") returned 10
	[0092.604] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0092.605] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0092.605] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0092.605] lstrlenW (lpString="utg2.exe") returned 8
	[0092.606] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0092.606] lstrlenW (lpString="interventions.exe") returned 17
	[0092.606] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0092.607] lstrlenW (lpString="hayes.exe") returned 9
	[0092.607] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0092.608] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0092.608] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0092.609] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0092.609] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0092.611] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0092.611] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0092.612] lstrlenW (lpString="taskhost.exe") returned 12
	[0092.612] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0092.612] lstrlenW (lpString="000005.exe") returned 10
	[0092.613] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0092.613] lstrlenW (lpString="cmd.exe") returned 7
	[0092.613] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0092.614] lstrlenW (lpString="conhost.exe") returned 11
	[0092.614] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0092.615] lstrlenW (lpString="vssadmin.exe") returned 12
	[0092.615] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0092.616] lstrlenW (lpString="VSSVC.exe") returned 9
	[0092.616] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.616] lstrlenW (lpString="svchost.exe") returned 11
	[0092.617] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0092.617] lstrlenW (lpString="svchost.exe") returned 11
	[0092.618] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0092.618] CloseHandle (hObject=0x204) returned 1
	[0092.619] Sleep (dwMilliseconds=0x1f4) 
	[0093.133] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0093.134] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0093.134] GetLastError () returned 0xea
	[0093.134] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12b4) returned 0x32e8f8
	[0093.135] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e8f8, cbBufSize=0x12b4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e8f8, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0093.135] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0093.136] lstrlenW (lpString="Appinfo") returned 7
	[0093.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0093.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0093.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0093.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0093.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0093.137] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0093.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0093.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0093.137] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0093.137] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0093.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0093.137] lstrlenW (lpString="AudioSrv") returned 8
	[0093.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0093.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0093.138] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0093.138] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0093.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0093.138] lstrlenW (lpString="BFE") returned 3
	[0093.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0093.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0093.138] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0093.139] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0093.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0093.139] lstrlenW (lpString="CryptSvc") returned 8
	[0093.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0093.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0093.139] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0093.139] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0093.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0093.140] lstrlenW (lpString="CscService") returned 10
	[0093.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0093.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0093.140] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0093.140] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0093.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0093.140] lstrlenW (lpString="DcomLaunch") returned 10
	[0093.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0093.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0093.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0093.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0093.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0093.141] lstrlenW (lpString="Dhcp") returned 4
	[0093.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0093.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0093.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0093.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0093.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0093.142] lstrlenW (lpString="Dnscache") returned 8
	[0093.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0093.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0093.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0093.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0093.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0093.142] lstrlenW (lpString="DPS") returned 3
	[0093.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0093.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0093.143] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0093.143] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0093.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0093.143] lstrlenW (lpString="eventlog") returned 8
	[0093.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0093.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0093.143] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0093.144] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0093.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0093.144] lstrlenW (lpString="EventSystem") returned 11
	[0093.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0093.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0093.144] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0093.144] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0093.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0093.144] lstrlenW (lpString="FontCache") returned 9
	[0093.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0093.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0093.145] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0093.145] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0093.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0093.145] lstrlenW (lpString="gpsvc") returned 5
	[0093.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0093.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0093.146] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0093.146] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0093.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0093.146] lstrlenW (lpString="iphlpsvc") returned 8
	[0093.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0093.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0093.146] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0093.146] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0093.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0093.147] lstrlenW (lpString="LanmanServer") returned 12
	[0093.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0093.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0093.147] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0093.147] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0093.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0093.147] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0093.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0093.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0093.148] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0093.148] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0093.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0093.148] lstrlenW (lpString="lmhosts") returned 7
	[0093.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0093.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0093.149] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0093.149] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0093.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0093.149] lstrlenW (lpString="MMCSS") returned 5
	[0093.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0093.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0093.149] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0093.149] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0093.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0093.150] lstrlenW (lpString="MpsSvc") returned 6
	[0093.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0093.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0093.150] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0093.150] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0093.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0093.150] lstrlenW (lpString="Netman") returned 6
	[0093.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0093.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0093.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0093.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0093.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0093.151] lstrlenW (lpString="netprofm") returned 8
	[0093.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0093.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0093.151] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0093.151] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0093.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0093.151] lstrlenW (lpString="NlaSvc") returned 6
	[0093.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0093.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0093.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0093.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0093.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0093.152] lstrlenW (lpString="nsi") returned 3
	[0093.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0093.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0093.152] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0093.152] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0093.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0093.153] lstrlenW (lpString="PcaSvc") returned 6
	[0093.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0093.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0093.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0093.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0093.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0093.153] lstrlenW (lpString="PlugPlay") returned 8
	[0093.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0093.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0093.154] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0093.154] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0093.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0093.154] lstrlenW (lpString="Power") returned 5
	[0093.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0093.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0093.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0093.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0093.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0093.154] lstrlenW (lpString="ProfSvc") returned 7
	[0093.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0093.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0093.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0093.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0093.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0093.155] lstrlenW (lpString="RpcEptMapper") returned 12
	[0093.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0093.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0093.155] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0093.155] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0093.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0093.156] lstrlenW (lpString="RpcSs") returned 5
	[0093.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0093.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0093.156] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0093.156] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0093.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0093.156] lstrlenW (lpString="SamSs") returned 5
	[0093.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0093.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0093.157] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0093.157] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0093.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0093.157] lstrlenW (lpString="Schedule") returned 8
	[0093.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0093.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0093.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0093.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0093.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0093.158] lstrlenW (lpString="SENS") returned 4
	[0093.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0093.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0093.158] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0093.158] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0093.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0093.158] lstrlenW (lpString="ShellHWDetection") returned 16
	[0093.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0093.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0093.159] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0093.159] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0093.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0093.159] lstrlenW (lpString="Spooler") returned 7
	[0093.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0093.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0093.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0093.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0093.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0093.160] lstrlenW (lpString="swprv") returned 5
	[0093.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0093.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0093.160] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0093.160] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0093.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0093.160] lstrlenW (lpString="SysMain") returned 7
	[0093.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0093.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0093.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0093.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0093.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0093.161] lstrlenW (lpString="Themes") returned 6
	[0093.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0093.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0093.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0093.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0093.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0093.162] lstrlenW (lpString="TrkWks") returned 6
	[0093.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0093.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0093.162] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0093.162] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0093.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0093.162] lstrlenW (lpString="UxSms") returned 5
	[0093.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0093.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0093.163] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0093.163] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0093.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0093.163] lstrlenW (lpString="VSS") returned 3
	[0093.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0093.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0093.163] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0093.163] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0093.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0093.164] lstrlenW (lpString="WdiServiceHost") returned 14
	[0093.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0093.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0093.164] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0093.164] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0093.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0093.164] lstrlenW (lpString="WdiSystemHost") returned 13
	[0093.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0093.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0093.165] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0093.165] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0093.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0093.165] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0093.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.165] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.165] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0093.166] lstrlenW (lpString="Winmgmt") returned 7
	[0093.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0093.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0093.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0093.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0093.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0093.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e8f8 | out: hHeap=0x2e0000) returned 1
	[0093.166] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204
	[0093.264] Process32FirstW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0093.265] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0093.265] lstrlenW (lpString="System") returned 6
	[0093.265] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0093.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0093.266] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0093.266] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0093.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0093.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0093.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0093.266] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0093.267] lstrlenW (lpString="smss.exe") returned 8
	[0093.267] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0093.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0093.267] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0093.267] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0093.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0093.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0093.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0093.268] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0093.268] lstrlenW (lpString="csrss.exe") returned 9
	[0093.269] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0093.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0093.269] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0093.269] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0093.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0093.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0093.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0093.269] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0093.270] lstrlenW (lpString="wininit.exe") returned 11
	[0093.270] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0093.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0093.271] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0093.271] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0093.272] lstrlenW (lpString="csrss.exe") returned 9
	[0093.272] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0093.272] lstrlenW (lpString="winlogon.exe") returned 12
	[0093.273] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0093.274] lstrlenW (lpString="services.exe") returned 12
	[0093.274] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0093.275] lstrlenW (lpString="lsass.exe") returned 9
	[0093.275] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0093.275] lstrlenW (lpString="lsm.exe") returned 7
	[0093.275] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.276] lstrlenW (lpString="svchost.exe") returned 11
	[0093.276] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.277] lstrlenW (lpString="svchost.exe") returned 11
	[0093.277] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.278] lstrlenW (lpString="svchost.exe") returned 11
	[0093.278] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.279] lstrlenW (lpString="svchost.exe") returned 11
	[0093.279] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.280] lstrlenW (lpString="svchost.exe") returned 11
	[0093.280] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0093.281] lstrlenW (lpString="audiodg.exe") returned 11
	[0093.281] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.281] lstrlenW (lpString="svchost.exe") returned 11
	[0093.282] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.282] lstrlenW (lpString="svchost.exe") returned 11
	[0093.282] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0093.283] lstrlenW (lpString="dwm.exe") returned 7
	[0093.283] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0093.284] lstrlenW (lpString="explorer.exe") returned 12
	[0093.284] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0093.285] lstrlenW (lpString="spoolsv.exe") returned 11
	[0093.285] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.290] lstrlenW (lpString="svchost.exe") returned 11
	[0093.290] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0093.291] lstrlenW (lpString="taskhost.exe") returned 12
	[0093.291] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0093.292] lstrlenW (lpString="taskeng.exe") returned 11
	[0093.292] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0093.292] lstrlenW (lpString="elliott grace.exe") returned 17
	[0093.293] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0093.293] lstrlenW (lpString="floyd.exe") returned 9
	[0093.293] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0093.294] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0093.294] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0093.294] lstrlenW (lpString="bond.exe") returned 8
	[0093.294] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0093.295] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0093.295] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0093.296] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0093.296] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0093.296] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0093.296] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0093.297] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0093.297] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0093.298] lstrlenW (lpString="wheel_year.exe") returned 14
	[0093.298] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0093.298] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0093.298] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0093.299] lstrlenW (lpString="alifilm.exe") returned 11
	[0093.299] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0093.299] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0093.300] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0093.300] lstrlenW (lpString="orchestra.exe") returned 13
	[0093.300] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0093.301] lstrlenW (lpString="decade.exe") returned 10
	[0093.301] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0093.302] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0093.302] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0093.302] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0093.302] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0093.414] lstrlenW (lpString="bracket das.exe") returned 15
	[0093.415] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0093.415] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0093.415] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0093.416] lstrlenW (lpString="3dftp.exe") returned 9
	[0093.416] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0093.417] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0093.417] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0093.418] lstrlenW (lpString="alftp.exe") returned 9
	[0093.418] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0093.418] lstrlenW (lpString="barca.exe") returned 9
	[0093.419] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0093.419] lstrlenW (lpString="bitkinex.exe") returned 12
	[0093.419] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0093.420] lstrlenW (lpString="coreftp.exe") returned 11
	[0093.420] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0093.421] lstrlenW (lpString="far.exe") returned 7
	[0093.421] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0093.422] lstrlenW (lpString="filezilla.exe") returned 13
	[0093.422] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0093.422] lstrlenW (lpString="flashfxp.exe") returned 12
	[0093.423] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0093.423] lstrlenW (lpString="fling.exe") returned 9
	[0093.423] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0093.425] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0093.425] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0093.426] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0093.426] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0093.427] lstrlenW (lpString="icq.exe") returned 7
	[0093.427] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0093.427] lstrlenW (lpString="leechftp.exe") returned 12
	[0093.427] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0093.428] lstrlenW (lpString="ncftp.exe") returned 9
	[0093.428] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0093.429] lstrlenW (lpString="notepad.exe") returned 11
	[0093.429] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0093.430] lstrlenW (lpString="operamail.exe") returned 13
	[0093.430] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0093.431] lstrlenW (lpString="pidgin.exe") returned 10
	[0093.431] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0093.432] lstrlenW (lpString="scriptftp.exe") returned 13
	[0093.432] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0093.433] lstrlenW (lpString="skype.exe") returned 9
	[0093.433] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0093.434] lstrlenW (lpString="smartftp.exe") returned 12
	[0093.434] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0093.435] lstrlenW (lpString="thunderbird.exe") returned 15
	[0093.435] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0093.436] lstrlenW (lpString="totalcmd.exe") returned 12
	[0093.436] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0093.437] lstrlenW (lpString="trillian.exe") returned 12
	[0093.437] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0093.437] lstrlenW (lpString="webdrive.exe") returned 12
	[0093.438] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0093.438] lstrlenW (lpString="whatsapp.exe") returned 12
	[0093.439] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0093.439] lstrlenW (lpString="winscp.exe") returned 10
	[0093.440] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0093.440] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0093.440] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0093.441] lstrlenW (lpString="active-charge.exe") returned 17
	[0093.441] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0093.442] lstrlenW (lpString="accupos.exe") returned 11
	[0093.442] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0093.443] lstrlenW (lpString="afr38.exe") returned 9
	[0093.443] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0093.444] lstrlenW (lpString="aldelo.exe") returned 10
	[0093.444] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0093.445] lstrlenW (lpString="ccv_server.exe") returned 14
	[0093.445] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0093.446] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0093.446] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0093.492] lstrlenW (lpString="creditservice.exe") returned 17
	[0093.492] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0093.493] lstrlenW (lpString="edcsvr.exe") returned 10
	[0093.493] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0093.494] lstrlenW (lpString="fpos.exe") returned 8
	[0093.494] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0093.494] lstrlenW (lpString="isspos.exe") returned 10
	[0093.495] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0093.495] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0093.496] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0093.496] lstrlenW (lpString="omnipos.exe") returned 11
	[0093.496] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0093.497] lstrlenW (lpString="spcwin.exe") returned 10
	[0093.497] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0093.498] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0093.498] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0093.499] lstrlenW (lpString="utg2.exe") returned 8
	[0093.499] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0093.500] lstrlenW (lpString="interventions.exe") returned 17
	[0093.500] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0093.500] lstrlenW (lpString="hayes.exe") returned 9
	[0093.501] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0093.501] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0093.501] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0093.502] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0093.502] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0093.503] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0093.503] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0093.504] lstrlenW (lpString="taskhost.exe") returned 12
	[0093.504] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0093.505] lstrlenW (lpString="000005.exe") returned 10
	[0093.505] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0093.505] lstrlenW (lpString="cmd.exe") returned 7
	[0093.506] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0093.506] lstrlenW (lpString="conhost.exe") returned 11
	[0093.506] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0093.507] lstrlenW (lpString="vssadmin.exe") returned 12
	[0093.508] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0093.508] lstrlenW (lpString="VSSVC.exe") returned 9
	[0093.508] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.509] lstrlenW (lpString="svchost.exe") returned 11
	[0093.509] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0093.510] lstrlenW (lpString="svchost.exe") returned 11
	[0093.510] Process32NextW (in: hSnapshot=0x204, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0093.511] CloseHandle (hObject=0x204) returned 1
	[0093.511] Sleep (dwMilliseconds=0x1f4) 
	[0094.590] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339e98
	[0094.591] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0094.592] GetLastError () returned 0xea
	[0094.592] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12b4) returned 0x32e7b0
	[0094.593] EnumServicesStatusExW (in: hSCManager=0x339e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x12b4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0094.594] CloseServiceHandle (hSCObject=0x339e98) returned 1
	[0094.595] lstrlenW (lpString="Appinfo") returned 7
	[0094.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0094.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0094.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0094.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0094.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0094.596] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0094.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0094.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0094.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0094.598] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0094.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0094.598] lstrlenW (lpString="AudioSrv") returned 8
	[0094.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0094.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0094.598] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0094.599] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0094.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0094.599] lstrlenW (lpString="BFE") returned 3
	[0094.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0094.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0094.600] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0094.600] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0094.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0094.600] lstrlenW (lpString="CryptSvc") returned 8
	[0094.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0094.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0094.601] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0094.601] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0094.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0094.601] lstrlenW (lpString="CscService") returned 10
	[0094.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0094.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0094.602] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0094.602] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0094.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0094.602] lstrlenW (lpString="DcomLaunch") returned 10
	[0094.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0094.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0094.602] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0094.603] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0094.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0094.603] lstrlenW (lpString="Dhcp") returned 4
	[0094.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0094.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0094.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0094.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0094.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0094.604] lstrlenW (lpString="Dnscache") returned 8
	[0094.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0094.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0094.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0094.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0094.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0094.605] lstrlenW (lpString="DPS") returned 3
	[0094.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0094.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0094.605] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0094.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0094.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0094.606] lstrlenW (lpString="eventlog") returned 8
	[0094.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0094.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0094.606] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0094.607] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0094.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0094.607] lstrlenW (lpString="EventSystem") returned 11
	[0094.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0094.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0094.608] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0094.608] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0094.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0094.608] lstrlenW (lpString="FontCache") returned 9
	[0094.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0094.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0094.609] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0094.609] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0094.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0094.609] lstrlenW (lpString="gpsvc") returned 5
	[0094.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0094.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0094.609] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0094.610] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0094.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0094.610] lstrlenW (lpString="iphlpsvc") returned 8
	[0094.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0094.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0094.610] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0094.611] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0094.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0094.611] lstrlenW (lpString="LanmanServer") returned 12
	[0094.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0094.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0094.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0094.612] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0094.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0094.612] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0094.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0094.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0094.612] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0094.613] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0094.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0094.613] lstrlenW (lpString="lmhosts") returned 7
	[0094.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0094.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0094.613] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0094.614] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0094.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0094.614] lstrlenW (lpString="MMCSS") returned 5
	[0094.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0094.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0094.615] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0094.615] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0094.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0094.616] lstrlenW (lpString="MpsSvc") returned 6
	[0094.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0094.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0094.616] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0094.616] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0094.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0094.617] lstrlenW (lpString="Netman") returned 6
	[0094.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0094.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0094.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0094.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0094.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0094.618] lstrlenW (lpString="netprofm") returned 8
	[0094.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0094.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0094.618] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0094.618] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0094.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0094.619] lstrlenW (lpString="NlaSvc") returned 6
	[0094.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0094.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0094.619] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0094.619] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0094.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0094.620] lstrlenW (lpString="nsi") returned 3
	[0094.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0094.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0094.620] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0094.620] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0094.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0094.621] lstrlenW (lpString="PcaSvc") returned 6
	[0094.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0094.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0094.621] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0094.621] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0094.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0094.622] lstrlenW (lpString="PlugPlay") returned 8
	[0094.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0094.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0094.622] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0094.622] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0094.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0094.623] lstrlenW (lpString="Power") returned 5
	[0094.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0094.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0094.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0094.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0094.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0094.624] lstrlenW (lpString="ProfSvc") returned 7
	[0094.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0094.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0094.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0094.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0094.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0094.625] lstrlenW (lpString="RpcEptMapper") returned 12
	[0094.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0094.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0094.625] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0094.625] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0094.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0094.626] lstrlenW (lpString="RpcSs") returned 5
	[0094.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0094.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0094.626] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0094.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0094.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0094.627] lstrlenW (lpString="SamSs") returned 5
	[0094.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0094.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0094.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0094.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0094.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0094.628] lstrlenW (lpString="Schedule") returned 8
	[0094.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0094.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0094.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0094.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0094.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0094.629] lstrlenW (lpString="SENS") returned 4
	[0094.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0094.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0094.629] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0094.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0094.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0095.126] lstrlenW (lpString="ShellHWDetection") returned 16
	[0095.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0095.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0095.129] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0095.129] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0095.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0095.130] lstrlenW (lpString="Spooler") returned 7
	[0095.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0095.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0095.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0095.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0095.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0095.131] lstrlenW (lpString="swprv") returned 5
	[0095.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0095.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0095.131] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0095.131] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0095.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0095.132] lstrlenW (lpString="SysMain") returned 7
	[0095.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0095.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0095.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0095.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0095.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0095.133] lstrlenW (lpString="Themes") returned 6
	[0095.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0095.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0095.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0095.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0095.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0095.134] lstrlenW (lpString="TrkWks") returned 6
	[0095.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0095.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0095.134] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0095.134] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0095.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0095.134] lstrlenW (lpString="UxSms") returned 5
	[0095.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0095.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0095.135] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0095.135] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0095.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0095.135] lstrlenW (lpString="VSS") returned 3
	[0095.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0095.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0095.136] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0095.136] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0095.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0095.136] lstrlenW (lpString="WdiServiceHost") returned 14
	[0095.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0095.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0095.137] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0095.137] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0095.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0095.137] lstrlenW (lpString="WdiSystemHost") returned 13
	[0095.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0095.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0095.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0095.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0095.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0095.138] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0095.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0095.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0095.139] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0095.139] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0095.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0095.139] lstrlenW (lpString="Winmgmt") returned 7
	[0095.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0095.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0095.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0095.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0095.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0095.140] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0095.140] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4
	[0095.147] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0095.148] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0095.148] lstrlenW (lpString="System") returned 6
	[0095.149] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0095.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0095.149] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0095.149] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0095.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0095.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0095.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0095.150] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0095.150] lstrlenW (lpString="smss.exe") returned 8
	[0095.150] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0095.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0095.151] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0095.151] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0095.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0095.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0095.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0095.151] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0095.152] lstrlenW (lpString="csrss.exe") returned 9
	[0095.152] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0095.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0095.152] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0095.152] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0095.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0095.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0095.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0095.153] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0095.154] lstrlenW (lpString="wininit.exe") returned 11
	[0095.154] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0095.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0095.154] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0095.154] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0095.155] lstrlenW (lpString="csrss.exe") returned 9
	[0095.155] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0095.155] lstrlenW (lpString="winlogon.exe") returned 12
	[0095.156] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0095.156] lstrlenW (lpString="services.exe") returned 12
	[0095.156] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0095.157] lstrlenW (lpString="lsass.exe") returned 9
	[0095.157] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0095.158] lstrlenW (lpString="lsm.exe") returned 7
	[0095.158] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.158] lstrlenW (lpString="svchost.exe") returned 11
	[0095.158] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.159] lstrlenW (lpString="svchost.exe") returned 11
	[0095.159] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.160] lstrlenW (lpString="svchost.exe") returned 11
	[0095.160] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.728] lstrlenW (lpString="svchost.exe") returned 11
	[0095.730] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.732] lstrlenW (lpString="svchost.exe") returned 11
	[0095.733] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0095.733] lstrlenW (lpString="audiodg.exe") returned 11
	[0095.734] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.734] lstrlenW (lpString="svchost.exe") returned 11
	[0095.735] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.735] lstrlenW (lpString="svchost.exe") returned 11
	[0095.735] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0095.736] lstrlenW (lpString="dwm.exe") returned 7
	[0095.736] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0095.737] lstrlenW (lpString="explorer.exe") returned 12
	[0095.737] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0095.738] lstrlenW (lpString="spoolsv.exe") returned 11
	[0095.738] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0095.739] lstrlenW (lpString="svchost.exe") returned 11
	[0095.739] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0095.740] lstrlenW (lpString="taskhost.exe") returned 12
	[0095.740] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0095.741] lstrlenW (lpString="taskeng.exe") returned 11
	[0095.741] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0095.742] lstrlenW (lpString="elliott grace.exe") returned 17
	[0095.742] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0095.743] lstrlenW (lpString="floyd.exe") returned 9
	[0095.743] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0095.743] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0095.744] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0095.744] lstrlenW (lpString="bond.exe") returned 8
	[0095.744] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0095.745] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0095.745] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0095.746] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0095.746] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0095.747] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0095.747] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0095.748] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0095.748] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0095.749] lstrlenW (lpString="wheel_year.exe") returned 14
	[0095.749] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0095.750] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0095.750] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0095.751] lstrlenW (lpString="alifilm.exe") returned 11
	[0095.751] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0095.751] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0095.752] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0095.752] lstrlenW (lpString="orchestra.exe") returned 13
	[0095.753] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0095.754] lstrlenW (lpString="decade.exe") returned 10
	[0095.754] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0095.755] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0095.755] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0095.756] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0095.756] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0095.757] lstrlenW (lpString="bracket das.exe") returned 15
	[0095.757] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0095.758] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0095.758] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0095.759] lstrlenW (lpString="3dftp.exe") returned 9
	[0095.759] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0095.760] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0095.760] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0095.761] lstrlenW (lpString="alftp.exe") returned 9
	[0095.761] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0095.761] lstrlenW (lpString="barca.exe") returned 9
	[0095.762] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0095.762] lstrlenW (lpString="bitkinex.exe") returned 12
	[0095.762] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0095.763] lstrlenW (lpString="coreftp.exe") returned 11
	[0095.763] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0095.764] lstrlenW (lpString="far.exe") returned 7
	[0095.764] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0095.765] lstrlenW (lpString="filezilla.exe") returned 13
	[0095.765] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0095.766] lstrlenW (lpString="flashfxp.exe") returned 12
	[0095.766] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0095.766] lstrlenW (lpString="fling.exe") returned 9
	[0095.767] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0095.767] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0095.767] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0095.768] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0095.768] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0096.083] lstrlenW (lpString="icq.exe") returned 7
	[0096.083] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0096.084] lstrlenW (lpString="leechftp.exe") returned 12
	[0096.084] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0096.085] lstrlenW (lpString="ncftp.exe") returned 9
	[0096.085] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0096.086] lstrlenW (lpString="notepad.exe") returned 11
	[0096.086] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0096.087] lstrlenW (lpString="operamail.exe") returned 13
	[0096.087] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0096.088] lstrlenW (lpString="pidgin.exe") returned 10
	[0096.089] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0096.090] lstrlenW (lpString="scriptftp.exe") returned 13
	[0096.090] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0096.091] lstrlenW (lpString="skype.exe") returned 9
	[0096.091] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0096.092] lstrlenW (lpString="smartftp.exe") returned 12
	[0096.092] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0096.093] lstrlenW (lpString="thunderbird.exe") returned 15
	[0096.093] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0096.094] lstrlenW (lpString="totalcmd.exe") returned 12
	[0096.094] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0096.095] lstrlenW (lpString="trillian.exe") returned 12
	[0096.095] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0096.097] lstrlenW (lpString="webdrive.exe") returned 12
	[0096.097] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0096.098] lstrlenW (lpString="whatsapp.exe") returned 12
	[0096.098] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0096.099] lstrlenW (lpString="winscp.exe") returned 10
	[0096.099] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0096.100] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0096.100] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0096.101] lstrlenW (lpString="active-charge.exe") returned 17
	[0096.101] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0096.102] lstrlenW (lpString="accupos.exe") returned 11
	[0096.102] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0096.103] lstrlenW (lpString="afr38.exe") returned 9
	[0096.103] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0096.104] lstrlenW (lpString="aldelo.exe") returned 10
	[0096.105] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0096.105] lstrlenW (lpString="ccv_server.exe") returned 14
	[0096.106] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0096.106] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0096.107] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0096.107] lstrlenW (lpString="creditservice.exe") returned 17
	[0096.108] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0096.109] lstrlenW (lpString="edcsvr.exe") returned 10
	[0096.109] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0096.110] lstrlenW (lpString="fpos.exe") returned 8
	[0096.110] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0096.111] lstrlenW (lpString="isspos.exe") returned 10
	[0096.111] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0096.112] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0096.112] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0096.113] lstrlenW (lpString="omnipos.exe") returned 11
	[0096.113] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0096.114] lstrlenW (lpString="spcwin.exe") returned 10
	[0096.114] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0096.115] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0096.115] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0096.116] lstrlenW (lpString="utg2.exe") returned 8
	[0096.116] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0096.117] lstrlenW (lpString="interventions.exe") returned 17
	[0096.118] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0096.118] lstrlenW (lpString="hayes.exe") returned 9
	[0096.119] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0096.119] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0096.120] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0096.120] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0096.120] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0096.121] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0096.121] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0096.122] lstrlenW (lpString="taskhost.exe") returned 12
	[0096.122] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0096.123] lstrlenW (lpString="000005.exe") returned 10
	[0096.123] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0096.124] lstrlenW (lpString="cmd.exe") returned 7
	[0096.124] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0096.125] lstrlenW (lpString="conhost.exe") returned 11
	[0096.125] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0096.126] lstrlenW (lpString="vssadmin.exe") returned 12
	[0096.126] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0096.126] lstrlenW (lpString="VSSVC.exe") returned 9
	[0096.127] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.127] lstrlenW (lpString="svchost.exe") returned 11
	[0096.127] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0096.618] lstrlenW (lpString="svchost.exe") returned 11
	[0096.619] Process32NextW (in: hSnapshot=0x1f4, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0096.619] CloseHandle (hObject=0x1f4) returned 1
	[0096.620] Sleep (dwMilliseconds=0x1f4) 
	[0097.518] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339da8
	[0097.518] EnumServicesStatusExW (in: hSCManager=0x339da8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0097.519] GetLastError () returned 0xea
	[0097.519] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12b4) returned 0x32e7b0
	[0097.520] EnumServicesStatusExW (in: hSCManager=0x339da8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x12b4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0097.521] CloseServiceHandle (hSCObject=0x339da8) returned 1
	[0097.522] lstrlenW (lpString="Appinfo") returned 7
	[0097.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0097.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0097.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0097.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0097.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0097.523] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0097.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0097.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0097.523] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0097.524] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0097.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0097.524] lstrlenW (lpString="AudioSrv") returned 8
	[0097.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0097.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0097.524] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0097.525] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0097.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0097.525] lstrlenW (lpString="BFE") returned 3
	[0097.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0097.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0097.526] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0097.526] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0097.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0097.526] lstrlenW (lpString="CryptSvc") returned 8
	[0097.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0097.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0097.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0097.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0097.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0097.527] lstrlenW (lpString="CscService") returned 10
	[0097.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0097.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0097.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0097.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0097.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0097.528] lstrlenW (lpString="DcomLaunch") returned 10
	[0097.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0097.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0097.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0097.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0097.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0097.529] lstrlenW (lpString="Dhcp") returned 4
	[0097.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0097.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0097.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0097.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0097.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0097.530] lstrlenW (lpString="Dnscache") returned 8
	[0097.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0097.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0097.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0097.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0097.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0097.530] lstrlenW (lpString="DPS") returned 3
	[0097.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0097.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0097.531] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0097.531] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0097.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0097.531] lstrlenW (lpString="eventlog") returned 8
	[0097.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0097.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0097.532] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0097.532] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0097.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0097.532] lstrlenW (lpString="EventSystem") returned 11
	[0097.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0097.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0097.532] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0097.532] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0097.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0097.533] lstrlenW (lpString="FontCache") returned 9
	[0097.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0097.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0097.533] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0097.533] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0097.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0097.533] lstrlenW (lpString="gpsvc") returned 5
	[0097.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0097.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0097.534] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0097.534] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0097.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0097.534] lstrlenW (lpString="iphlpsvc") returned 8
	[0097.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0097.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0097.534] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0097.534] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0097.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0097.535] lstrlenW (lpString="LanmanServer") returned 12
	[0097.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0097.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0097.535] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0097.535] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0097.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0097.535] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0097.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0097.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0097.536] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0097.536] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0097.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0097.536] lstrlenW (lpString="lmhosts") returned 7
	[0097.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0097.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0097.536] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0097.537] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0097.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0097.537] lstrlenW (lpString="MMCSS") returned 5
	[0097.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0097.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0097.537] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0097.537] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0097.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0097.538] lstrlenW (lpString="MpsSvc") returned 6
	[0097.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0097.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0097.538] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0097.538] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0097.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0097.538] lstrlenW (lpString="Netman") returned 6
	[0097.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0097.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0097.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0097.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0097.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0097.539] lstrlenW (lpString="netprofm") returned 8
	[0097.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0097.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0097.540] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0097.540] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0097.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0097.540] lstrlenW (lpString="NlaSvc") returned 6
	[0097.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0097.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0097.540] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0097.540] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0097.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0097.541] lstrlenW (lpString="nsi") returned 3
	[0097.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0097.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0097.541] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0097.541] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0097.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0097.541] lstrlenW (lpString="PcaSvc") returned 6
	[0097.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0097.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0097.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0097.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0097.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0097.542] lstrlenW (lpString="PlugPlay") returned 8
	[0097.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0097.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0097.543] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0097.543] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0097.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0097.543] lstrlenW (lpString="Power") returned 5
	[0097.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0097.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0097.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0097.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0097.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0097.544] lstrlenW (lpString="ProfSvc") returned 7
	[0097.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0097.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0097.544] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0097.544] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0097.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0097.544] lstrlenW (lpString="RpcEptMapper") returned 12
	[0097.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0097.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0097.545] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0097.545] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0097.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0097.545] lstrlenW (lpString="RpcSs") returned 5
	[0097.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0097.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0097.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0097.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0097.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0097.546] lstrlenW (lpString="SamSs") returned 5
	[0097.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0097.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0097.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0097.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0097.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0097.547] lstrlenW (lpString="Schedule") returned 8
	[0097.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0097.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0097.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0097.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0097.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0097.548] lstrlenW (lpString="SENS") returned 4
	[0097.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0097.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0097.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0097.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0097.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0097.549] lstrlenW (lpString="ShellHWDetection") returned 16
	[0097.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0097.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0097.549] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0097.549] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0097.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0097.550] lstrlenW (lpString="Spooler") returned 7
	[0097.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0097.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0097.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0097.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0097.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0097.550] lstrlenW (lpString="swprv") returned 5
	[0097.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0097.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0097.551] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0097.551] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0097.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0097.551] lstrlenW (lpString="SysMain") returned 7
	[0097.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0097.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0097.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0097.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0097.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0097.552] lstrlenW (lpString="Themes") returned 6
	[0097.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0097.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0097.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0097.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0097.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0097.553] lstrlenW (lpString="TrkWks") returned 6
	[0097.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0097.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0097.553] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0097.553] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0097.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0097.554] lstrlenW (lpString="UxSms") returned 5
	[0097.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0097.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0097.554] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0097.554] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0097.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0097.554] lstrlenW (lpString="VSS") returned 3
	[0097.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0097.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0097.555] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0097.555] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0097.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0097.555] lstrlenW (lpString="WdiServiceHost") returned 14
	[0097.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0097.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0097.556] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0097.556] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0097.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0097.556] lstrlenW (lpString="WdiSystemHost") returned 13
	[0097.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0097.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0097.556] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0097.556] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0097.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0097.557] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0097.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.557] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.557] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0097.557] lstrlenW (lpString="Winmgmt") returned 7
	[0097.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0097.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0097.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0097.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0097.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0097.558] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0097.558] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0
	[0097.784] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0097.785] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0097.786] lstrlenW (lpString="System") returned 6
	[0097.786] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0097.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0097.786] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0097.786] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0097.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0097.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0097.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0097.787] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0097.788] lstrlenW (lpString="smss.exe") returned 8
	[0097.788] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0097.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0097.788] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0097.788] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0097.788] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0097.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0097.789] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0097.789] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0097.789] lstrlenW (lpString="csrss.exe") returned 9
	[0097.790] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0097.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0097.790] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0097.790] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0097.790] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0097.790] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0097.791] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0097.791] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0097.791] lstrlenW (lpString="wininit.exe") returned 11
	[0097.791] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0097.791] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0097.792] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0097.792] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0097.792] lstrlenW (lpString="csrss.exe") returned 9
	[0097.793] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0097.793] lstrlenW (lpString="winlogon.exe") returned 12
	[0097.793] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0097.794] lstrlenW (lpString="services.exe") returned 12
	[0097.794] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0097.795] lstrlenW (lpString="lsass.exe") returned 9
	[0097.795] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0097.795] lstrlenW (lpString="lsm.exe") returned 7
	[0097.796] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.796] lstrlenW (lpString="svchost.exe") returned 11
	[0097.797] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.798] lstrlenW (lpString="svchost.exe") returned 11
	[0097.798] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.799] lstrlenW (lpString="svchost.exe") returned 11
	[0097.799] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.800] lstrlenW (lpString="svchost.exe") returned 11
	[0097.800] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.801] lstrlenW (lpString="svchost.exe") returned 11
	[0097.801] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0097.801] lstrlenW (lpString="audiodg.exe") returned 11
	[0097.801] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.802] lstrlenW (lpString="svchost.exe") returned 11
	[0097.802] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.803] lstrlenW (lpString="svchost.exe") returned 11
	[0097.803] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0097.804] lstrlenW (lpString="dwm.exe") returned 7
	[0097.804] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0097.805] lstrlenW (lpString="explorer.exe") returned 12
	[0097.805] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0097.806] lstrlenW (lpString="spoolsv.exe") returned 11
	[0097.806] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0097.806] lstrlenW (lpString="svchost.exe") returned 11
	[0097.807] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0097.807] lstrlenW (lpString="taskhost.exe") returned 12
	[0097.807] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0097.808] lstrlenW (lpString="taskeng.exe") returned 11
	[0097.808] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="elliott grace.exe")) returned 1
	[0097.809] lstrlenW (lpString="elliott grace.exe") returned 17
	[0097.809] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="floyd.exe")) returned 1
	[0097.810] lstrlenW (lpString="floyd.exe") returned 9
	[0097.810] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="warrior banners germany.exe")) returned 1
	[0097.810] lstrlenW (lpString="warrior banners germany.exe") returned 27
	[0097.811] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bond.exe")) returned 1
	[0097.811] lstrlenW (lpString="bond.exe") returned 8
	[0097.811] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient_pi_nodes.exe")) returned 1
	[0097.812] lstrlenW (lpString="patient_pi_nodes.exe") returned 20
	[0097.812] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="que-hugo-expand.exe")) returned 1
	[0097.813] lstrlenW (lpString="que-hugo-expand.exe") returned 19
	[0097.813] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dirty_bidding.exe")) returned 1
	[0097.814] lstrlenW (lpString="dirty_bidding.exe") returned 17
	[0097.814] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="recorderscoated.exe")) returned 1
	[0097.815] lstrlenW (lpString="recorderscoated.exe") returned 19
	[0097.815] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wheel_year.exe")) returned 1
	[0097.816] lstrlenW (lpString="wheel_year.exe") returned 14
	[0097.816] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution jamie.exe")) returned 1
	[0097.817] lstrlenW (lpString="revolution jamie.exe") returned 20
	[0097.817] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alifilm.exe")) returned 1
	[0097.817] lstrlenW (lpString="alifilm.exe") returned 11
	[0097.818] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_butter_deluxe.exe")) returned 1
	[0097.818] lstrlenW (lpString="insert_butter_deluxe.exe") returned 24
	[0097.819] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="orchestra.exe")) returned 1
	[0097.819] lstrlenW (lpString="orchestra.exe") returned 13
	[0097.820] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="decade.exe")) returned 1
	[0097.820] lstrlenW (lpString="decade.exe") returned 10
	[0097.820] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utilizeopinionpeas.exe")) returned 1
	[0097.821] lstrlenW (lpString="utilizeopinionpeas.exe") returned 22
	[0097.821] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dpi supposed.exe")) returned 1
	[0097.822] lstrlenW (lpString="dpi supposed.exe") returned 16
	[0097.822] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bracket das.exe")) returned 1
	[0097.823] lstrlenW (lpString="bracket das.exe") returned 15
	[0097.823] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="katie_shake_bloomberg.exe")) returned 1
	[0097.824] lstrlenW (lpString="katie_shake_bloomberg.exe") returned 25
	[0097.824] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0097.825] lstrlenW (lpString="3dftp.exe") returned 9
	[0097.825] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0097.826] lstrlenW (lpString="absolutetelnet.exe") returned 18
	[0097.826] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0097.827] lstrlenW (lpString="alftp.exe") returned 9
	[0097.827] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0097.827] lstrlenW (lpString="barca.exe") returned 9
	[0097.828] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0097.891] lstrlenW (lpString="bitkinex.exe") returned 12
	[0097.892] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0097.892] lstrlenW (lpString="coreftp.exe") returned 11
	[0097.893] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0097.893] lstrlenW (lpString="far.exe") returned 7
	[0097.894] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0097.894] lstrlenW (lpString="filezilla.exe") returned 13
	[0097.895] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0097.895] lstrlenW (lpString="flashfxp.exe") returned 12
	[0097.896] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0097.896] lstrlenW (lpString="fling.exe") returned 9
	[0097.897] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0097.897] lstrlenW (lpString="foxmailincmail.exe") returned 18
	[0097.898] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0097.899] lstrlenW (lpString="gmailnotifierpro.exe") returned 20
	[0097.899] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0097.900] lstrlenW (lpString="icq.exe") returned 7
	[0097.900] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0097.901] lstrlenW (lpString="leechftp.exe") returned 12
	[0097.901] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0097.905] lstrlenW (lpString="ncftp.exe") returned 9
	[0097.905] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0097.905] lstrlenW (lpString="notepad.exe") returned 11
	[0097.906] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0097.907] lstrlenW (lpString="operamail.exe") returned 13
	[0097.907] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0097.955] lstrlenW (lpString="pidgin.exe") returned 10
	[0097.955] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0097.956] lstrlenW (lpString="scriptftp.exe") returned 13
	[0097.956] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0097.957] lstrlenW (lpString="skype.exe") returned 9
	[0097.958] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0097.959] lstrlenW (lpString="smartftp.exe") returned 12
	[0097.959] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0097.960] lstrlenW (lpString="thunderbird.exe") returned 15
	[0097.960] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0097.961] lstrlenW (lpString="totalcmd.exe") returned 12
	[0097.961] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0097.962] lstrlenW (lpString="trillian.exe") returned 12
	[0097.963] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0097.964] lstrlenW (lpString="webdrive.exe") returned 12
	[0097.964] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0097.965] lstrlenW (lpString="whatsapp.exe") returned 12
	[0097.965] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0097.966] lstrlenW (lpString="winscp.exe") returned 10
	[0097.966] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0097.967] lstrlenW (lpString="yahoomessenger.exe") returned 18
	[0097.967] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0097.968] lstrlenW (lpString="active-charge.exe") returned 17
	[0097.969] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0097.970] lstrlenW (lpString="accupos.exe") returned 11
	[0097.970] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0097.971] lstrlenW (lpString="afr38.exe") returned 9
	[0097.971] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0097.972] lstrlenW (lpString="aldelo.exe") returned 10
	[0097.972] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0097.973] lstrlenW (lpString="ccv_server.exe") returned 14
	[0097.973] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0097.974] lstrlenW (lpString="centralcreditcard.exe") returned 21
	[0097.975] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0097.975] lstrlenW (lpString="creditservice.exe") returned 17
	[0097.976] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0097.976] lstrlenW (lpString="edcsvr.exe") returned 10
	[0097.977] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0097.977] lstrlenW (lpString="fpos.exe") returned 8
	[0097.978] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0097.979] lstrlenW (lpString="isspos.exe") returned 10
	[0097.979] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0097.980] lstrlenW (lpString="mxslipstream.exe") returned 16
	[0097.980] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0097.981] lstrlenW (lpString="omnipos.exe") returned 11
	[0097.981] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0097.982] lstrlenW (lpString="spcwin.exe") returned 10
	[0097.982] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0097.983] lstrlenW (lpString="spgagentservice.exe") returned 19
	[0097.983] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0097.984] lstrlenW (lpString="utg2.exe") returned 8
	[0098.190] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="interventions.exe")) returned 1
	[0098.190] lstrlenW (lpString="interventions.exe") returned 17
	[0098.191] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hayes.exe")) returned 1
	[0098.192] lstrlenW (lpString="hayes.exe") returned 9
	[0098.192] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bet_concepts.exe")) returned 1
	[0098.193] lstrlenW (lpString="bet_concepts.exe") returned 16
	[0098.193] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0098.194] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0098.194] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0098.195] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0098.195] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0098.196] lstrlenW (lpString="taskhost.exe") returned 12
	[0098.196] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="000005.exe")) returned 1
	[0098.197] lstrlenW (lpString="000005.exe") returned 10
	[0098.197] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0098.198] lstrlenW (lpString="cmd.exe") returned 7
	[0098.198] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0098.199] lstrlenW (lpString="conhost.exe") returned 11
	[0098.200] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0098.200] lstrlenW (lpString="vssadmin.exe") returned 12
	[0098.201] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0098.201] lstrlenW (lpString="VSSVC.exe") returned 9
	[0098.202] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0098.203] lstrlenW (lpString="svchost.exe") returned 11
	[0098.203] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0098.204] lstrlenW (lpString="svchost.exe") returned 11
	[0098.204] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0098.205] lstrlenW (lpString="LogonUI.exe") returned 11
	[0098.205] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0098.206] CloseHandle (hObject=0x1f0) returned 1
	[0098.206] Sleep (dwMilliseconds=0x1f4) 
	[0099.096] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x339da8
	[0099.097] EnumServicesStatusExW (in: hSCManager=0x339da8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0
	[0099.098] GetLastError () returned 0xea
	[0099.098] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12b4) returned 0x32e7b0
	[0099.099] EnumServicesStatusExW (in: hSCManager=0x339da8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32e7b0, cbBufSize=0x12b4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32e7b0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1
	[0099.101] CloseServiceHandle (hSCObject=0x339da8) returned 1
	[0099.101] lstrlenW (lpString="Appinfo") returned 7
	[0099.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0099.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0099.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0099.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0099.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0099.102] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0099.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0099.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0099.103] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0099.103] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0099.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0099.103] lstrlenW (lpString="AudioSrv") returned 8
	[0099.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0099.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0099.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0099.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0099.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0099.104] lstrlenW (lpString="BFE") returned 3
	[0099.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0099.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0099.105] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0099.105] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0099.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0099.105] lstrlenW (lpString="CryptSvc") returned 8
	[0099.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0099.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0099.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0099.106] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0099.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0099.106] lstrlenW (lpString="CscService") returned 10
	[0099.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0099.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0099.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0099.107] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0099.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0099.107] lstrlenW (lpString="DcomLaunch") returned 10
	[0099.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0099.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0099.108] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0099.108] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0099.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0099.108] lstrlenW (lpString="Dhcp") returned 4
	[0099.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0099.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0099.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0099.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0099.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0099.109] lstrlenW (lpString="Dnscache") returned 8
	[0099.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0099.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0099.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0099.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0099.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0099.110] lstrlenW (lpString="DPS") returned 3
	[0099.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0099.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0099.111] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0099.111] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0099.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0099.111] lstrlenW (lpString="eventlog") returned 8
	[0099.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0099.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0099.112] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0099.112] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0099.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0099.112] lstrlenW (lpString="EventSystem") returned 11
	[0099.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0099.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0099.113] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0099.113] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0099.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0099.113] lstrlenW (lpString="FontCache") returned 9
	[0099.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0099.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0099.114] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0099.114] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0099.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0099.114] lstrlenW (lpString="gpsvc") returned 5
	[0099.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0099.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0099.115] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0099.115] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0099.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0099.115] lstrlenW (lpString="iphlpsvc") returned 8
	[0099.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0099.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0099.116] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0099.116] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0099.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0099.116] lstrlenW (lpString="LanmanServer") returned 12
	[0099.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0099.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0099.117] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0099.117] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0099.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0099.117] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0099.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0099.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0099.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0099.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0099.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0099.118] lstrlenW (lpString="lmhosts") returned 7
	[0099.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0099.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0099.119] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0099.119] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0099.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0099.119] lstrlenW (lpString="MMCSS") returned 5
	[0099.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0099.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0099.121] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0099.121] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0099.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0099.121] lstrlenW (lpString="MpsSvc") returned 6
	[0099.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0099.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0099.121] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0099.122] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0099.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0099.122] lstrlenW (lpString="Netman") returned 6
	[0099.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0099.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0099.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0099.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0099.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0099.123] lstrlenW (lpString="netprofm") returned 8
	[0099.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0099.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0099.123] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0099.124] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0099.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0099.124] lstrlenW (lpString="NlaSvc") returned 6
	[0099.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0099.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0099.124] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0099.124] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0099.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0099.125] lstrlenW (lpString="nsi") returned 3
	[0099.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0099.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0099.125] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0099.125] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0099.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0099.126] lstrlenW (lpString="PcaSvc") returned 6
	[0099.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0099.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0099.126] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0099.127] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0099.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0099.127] lstrlenW (lpString="PlugPlay") returned 8
	[0099.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0099.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0099.128] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0099.128] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0099.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0099.128] lstrlenW (lpString="Power") returned 5
	[0099.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0099.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0099.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0099.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0099.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0099.129] lstrlenW (lpString="ProfSvc") returned 7
	[0099.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0099.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0099.129] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0099.129] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0099.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0099.130] lstrlenW (lpString="RpcEptMapper") returned 12
	[0099.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0099.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0099.130] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0099.130] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0099.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0099.131] lstrlenW (lpString="RpcSs") returned 5
	[0099.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0099.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0099.131] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0099.131] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0099.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0099.131] lstrlenW (lpString="SamSs") returned 5
	[0099.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0099.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0099.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0099.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0099.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0099.132] lstrlenW (lpString="Schedule") returned 8
	[0099.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0099.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0099.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0099.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0099.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0099.133] lstrlenW (lpString="SENS") returned 4
	[0099.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0099.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0099.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0099.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0099.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0099.134] lstrlenW (lpString="ShellHWDetection") returned 16
	[0099.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0099.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0099.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0099.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0099.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0099.134] lstrlenW (lpString="Spooler") returned 7
	[0099.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0099.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0099.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0099.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0099.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0099.135] lstrlenW (lpString="swprv") returned 5
	[0099.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0099.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0099.136] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0099.136] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0099.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0099.136] lstrlenW (lpString="SysMain") returned 7
	[0099.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0099.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0099.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0099.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0099.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0099.137] lstrlenW (lpString="Themes") returned 6
	[0099.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0099.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0099.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0099.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0099.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0099.354] lstrlenW (lpString="TrkWks") returned 6
	[0099.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0099.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0099.355] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0099.355] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0099.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0099.355] lstrlenW (lpString="UxSms") returned 5
	[0099.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0099.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0099.355] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0099.360] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0099.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0099.360] lstrlenW (lpString="VSS") returned 3
	[0099.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0099.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0099.360] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0099.361] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0099.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0099.361] lstrlenW (lpString="WdiServiceHost") returned 14
	[0099.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0099.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0099.361] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0099.361] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0099.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0099.362] lstrlenW (lpString="WdiSystemHost") returned 13
	[0099.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0099.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0099.362] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0099.362] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0099.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0099.363] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0099.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.363] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.363] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0099.364] lstrlenW (lpString="Winmgmt") returned 7
	[0099.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0099.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0099.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0099.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0099.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0099.365] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e7b0 | out: hHeap=0x2e0000) returned 1
	[0099.365] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0
	[0099.373] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0099.374] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0099.375] lstrlenW (lpString="System") returned 6
	[0099.375] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0099.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0099.375] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0099.376] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0099.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0099.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0099.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0099.376] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0099.377] lstrlenW (lpString="smss.exe") returned 8
	[0099.377] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0099.377] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0099.377] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0099.377] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0099.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0099.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0099.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0099.378] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.379] lstrlenW (lpString="csrss.exe") returned 9
	[0099.379] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0099.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0099.381] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0099.381] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0099.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0099.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0099.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0099.382] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0099.383] lstrlenW (lpString="wininit.exe") returned 11
	[0099.383] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0099.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0099.383] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0099.383] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.384] lstrlenW (lpString="csrss.exe") returned 9
	[0099.384] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0099.385] lstrlenW (lpString="winlogon.exe") returned 12
	[0099.385] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0099.386] lstrlenW (lpString="services.exe") returned 12
	[0099.386] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0099.387] lstrlenW (lpString="lsass.exe") returned 9
	[0099.387] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0099.388] lstrlenW (lpString="lsm.exe") returned 7
	[0099.389] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.390] lstrlenW (lpString="svchost.exe") returned 11
	[0099.390] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.391] lstrlenW (lpString="svchost.exe") returned 11
	[0099.391] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.392] lstrlenW (lpString="svchost.exe") returned 11
	[0099.392] Process32NextW (in: hSnapshot=0x1f0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1

Thread:
	id = 5
	os_tid = 0x364

	[0069.062] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff
	[0069.062] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x314a30 | out: hHeap=0x2e0000) returned 1

Thread:
	id = 6
	os_tid = 0x308

	[0069.080] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a30
	[0069.080] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a30, Size=0x20) returned 0x3159d0
	[0069.080] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3159d0, Size=0x40) returned 0x316b10
	[0069.080] GetLogicalDrives () returned 0x4
	[0069.081] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34d440
	[0069.081] GetComputerNameW (in: lpBuffer=0x34d444, nSize=0x23cff6c | out: lpBuffer="XDUWTFONO", nSize=0x23cff6c) returned 1
	[0069.082] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x35d448
	[0069.082] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23cff3c | out: lphEnum=0x23cff3c*=0x315fc0) returned 0x0
	[0069.083] WNetEnumResourceW (in: hEnum=0x315fc0, lpcCount=0x23cff38, lpBuffer=0x35d448, lpBufferSize=0x23cff40 | out: lpcCount=0x23cff38, lpBuffer=0x35d448, lpBufferSize=0x23cff40) returned 0x103
	[0069.083] WNetCloseEnum (hEnum=0x315fc0) returned 0x0
	[0069.083] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23cff3c | out: lphEnum=0x23cff3c*=0x3316b8) returned 0x0
	[0072.577] WNetEnumResourceW (in: hEnum=0x3316b8, lpcCount=0x23cff38, lpBuffer=0x35d448, lpBufferSize=0x23cff40 | out: lpcCount=0x23cff38, lpBuffer=0x35d448, lpBufferSize=0x23cff40) returned 0x0
	[0072.577] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x3612080
	[0072.578] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x35d448, lphEnum=0x23cff10 | out: lphEnum=0x23cff10*=0x316360) returned 0x0
	[0072.746] WNetEnumResourceW (in: hEnum=0x316360, lpcCount=0x23cff0c, lpBuffer=0x3612080, lpBufferSize=0x23cff14 | out: lpcCount=0x23cff0c, lpBuffer=0x3612080, lpBufferSize=0x23cff14) returned 0x103
	[0072.746] WNetCloseEnum (hEnum=0x316360) returned 0x0
	[0072.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x3d1e80
	[0072.746] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x35d468, lphEnum=0x23cff10 | out: lphEnum=0x23cff10*=0x0) returned 0x4b8
	[0095.728] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x3f3b040
	[0095.728] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x35d488, lphEnum=0x23cff10 | out: lphEnum=0x23cff10*=0x0) returned 0x4c6
	[0095.731] WNetEnumResourceW (in: hEnum=0x3316b8, lpcCount=0x23cff38, lpBuffer=0x35d448, lpBufferSize=0x23cff40 | out: lpcCount=0x23cff38, lpBuffer=0x35d448, lpBufferSize=0x23cff40) returned 0x103
	[0095.731] WNetCloseEnum (hEnum=0x3316b8) returned 0x0
	[0095.731] GetLogicalDrives () returned 0x4
	[0095.732] Sleep (dwMilliseconds=0x64) 
	[0096.140] GetLogicalDrives () returned 0x4
	[0096.141] Sleep (dwMilliseconds=0x64) 
	[0096.719] GetLogicalDrives () returned 0x4
	[0096.719] Sleep (dwMilliseconds=0x64) 
	[0097.417] GetLogicalDrives () returned 0x4
	[0097.417] Sleep (dwMilliseconds=0x64) 
	[0097.735] GetLogicalDrives () returned 0x4
	[0097.735] Sleep (dwMilliseconds=0x64) 
	[0097.992] GetLogicalDrives () returned 0x4
	[0097.992] Sleep (dwMilliseconds=0x64) 
	[0098.243] GetLogicalDrives () returned 0x4
	[0098.243] Sleep (dwMilliseconds=0x64) 
	[0098.933] GetLogicalDrives () returned 0x4
	[0098.933] Sleep (dwMilliseconds=0x64) 
	[0099.206] GetLogicalDrives () returned 0x4
	[0099.206] Sleep (dwMilliseconds=0x64) 
	[0099.638] GetLogicalDrives () returned 0x4
	[0099.638] Sleep (dwMilliseconds=0x64) 

Thread:
	id = 7
	os_tid = 0x440

	[0071.620] GetTickCount () returned 0x11489f8
	[0071.620] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x32bf78
	[0071.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128
	[0071.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130
	[0071.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134
	[0071.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0071.646] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330a40
	[0071.647] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330a40, Size=0x20) returned 0x3397e0
	[0071.647] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330a40
	[0071.647] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330a40, Size=0x20) returned 0x339808
	[0071.654] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0071.655] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0071.655] Wow64DisableWow64FsRedirection (in: OldValue=0x22cff84 | out: OldValue=0x22cff84*=0x0) returned 1
	[0071.655] lstrlenW (lpString="kernel32.dll") returned 12
	[0071.655] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3397e0 | out: hHeap=0x2e0000) returned 1
	[0071.656] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0071.656] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339808 | out: hHeap=0x2e0000) returned 1
	[0071.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x31b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0071.657] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0071.762] GetTickCount () returned 0x1148a94
	[0071.763] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0072.384] GetTickCount () returned 0x1148b20
	[0072.384] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0072.586] GetTickCount () returned 0x1148beb
	[0072.586] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0073.227] GetTickCount () returned 0x1148d23
	[0073.228] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0073.465] GetTickCount () returned 0x1148dfd
	[0073.465] GetTickCount () returned 0x1148dfd
	[0073.465] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0074.826] GetTickCount () returned 0x1148e8a
	[0074.826] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0074.954] GetTickCount () returned 0x1148f07
	[0074.954] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0075.100] GetTickCount () returned 0x1148fa3
	[0075.100] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0075.321] GetTickCount () returned 0x114907d
	[0075.321] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0075.681] GetTickCount () returned 0x1149148
	[0075.681] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0075.980] GetTickCount () returned 0x1149270
	[0075.980] GetTickCount () returned 0x1149270
	[0075.980] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0076.474] GetTickCount () returned 0x1149389
	[0076.474] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0076.829] GetTickCount () returned 0x11494e0
	[0076.829] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0076.977] GetTickCount () returned 0x114957c
	[0076.977] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0077.177] GetTickCount () returned 0x1149647
	[0077.177] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0077.649] GetTickCount () returned 0x1149750
	[0077.649] GetTickCount () returned 0x1149750
	[0077.649] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0077.949] GetTickCount () returned 0x1149879
	[0077.950] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0078.336] GetTickCount () returned 0x11499ff
	[0078.336] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0078.451] GetTickCount () returned 0x1149a6c
	[0078.451] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0078.906] GetTickCount () returned 0x1149c40
	[0078.906] GetTickCount () returned 0x1149c40
	[0078.906] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0079.378] GetTickCount () returned 0x1149e14
	[0079.378] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0079.911] GetTickCount () returned 0x114a026
	[0079.911] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0080.143] GetTickCount () returned 0x114a110
	[0080.143] GetTickCount () returned 0x114a110
	[0080.143] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0080.365] GetTickCount () returned 0x114a1eb
	[0080.365] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0080.476] GetTickCount () returned 0x114a258
	[0080.476] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0080.693] GetTickCount () returned 0x114a332
	[0080.693] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0080.899] GetTickCount () returned 0x114a3fd
	[0080.899] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0081.321] GetTickCount () returned 0x114a593
	[0081.321] GetTickCount () returned 0x114a593
	[0081.321] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0082.370] GetTickCount () returned 0x114a6fa
	[0082.370] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0083.673] GetTickCount () returned 0x114a851
	[0083.673] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0083.871] GetTickCount () returned 0x114a91c
	[0083.871] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.067] GetTickCount () returned 0x114a9d7
	[0084.067] GetTickCount () returned 0x114a9d7
	[0084.068] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.233] GetTickCount () returned 0x114aa54
	[0084.234] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.335] GetTickCount () returned 0x114aac1
	[0084.335] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.444] GetTickCount () returned 0x114ab2e
	[0084.444] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.553] GetTickCount () returned 0x114ab9b
	[0084.553] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.662] GetTickCount () returned 0x114ac08
	[0084.662] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.802] GetTickCount () returned 0x114ac95
	[0084.803] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0084.914] GetTickCount () returned 0x114ad02
	[0084.914] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0085.021] GetTickCount () returned 0x114ad6f
	[0085.021] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0085.130] GetTickCount () returned 0x114addc
	[0085.131] GetTickCount () returned 0x114addc
	[0085.131] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0085.254] GetTickCount () returned 0x114ae4a
	[0085.254] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0085.349] GetTickCount () returned 0x114aeb7
	[0085.349] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0085.461] GetTickCount () returned 0x114af24
	[0085.461] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0085.610] GetTickCount () returned 0x114afb0
	[0085.610] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0086.036] GetTickCount () returned 0x114b156
	[0086.036] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0086.214] GetTickCount () returned 0x114b201
	[0086.214] GetTickCount () returned 0x114b201
	[0086.214] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0086.483] GetTickCount () returned 0x114b30a
	[0086.483] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0086.770] GetTickCount () returned 0x114b433
	[0086.770] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0086.920] GetTickCount () returned 0x114b4bf
	[0086.921] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0087.053] GetTickCount () returned 0x114b54c
	[0087.053] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0089.293] GetTickCount () returned 0x114b5c8
	[0089.293] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0089.390] GetTickCount () returned 0x114b636
	[0089.390] GetTickCount () returned 0x114b636
	[0089.390] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0089.538] GetTickCount () returned 0x114b6c2
	[0089.538] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0089.639] GetTickCount () returned 0x114b72f
	[0089.639] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0089.813] GetTickCount () returned 0x114b7db
	[0089.813] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0090.028] GetTickCount () returned 0x114b8b5
	[0090.029] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0090.217] GetTickCount () returned 0x114b970
	[0090.217] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0090.387] GetTickCount () returned 0x114ba1c
	[0090.388] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0090.544] GetTickCount () returned 0x114ba89
	[0090.544] GetTickCount () returned 0x114ba89
	[0090.544] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0090.677] GetTickCount () returned 0x114bb06
	[0090.677] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0090.805] GetTickCount () returned 0x114bb83
	[0090.805] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0090.947] GetTickCount () returned 0x114bc0f
	[0090.947] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0091.165] GetTickCount () returned 0x114bcea
	[0091.165] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0091.392] GetTickCount () returned 0x114bdd4
	[0091.392] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0091.558] GetTickCount () returned 0x114be7f
	[0091.558] GetTickCount () returned 0x114be7f
	[0091.558] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0091.677] GetTickCount () returned 0x114beec
	[0091.677] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0091.823] GetTickCount () returned 0x114bf5a
	[0091.823] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0092.264] GetTickCount () returned 0x114bfd6
	[0092.264] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0092.492] GetTickCount () returned 0x114c0b1
	[0092.492] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0092.611] GetTickCount () returned 0x114c12e
	[0092.611] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0092.712] GetTickCount () returned 0x114c19b
	[0092.712] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0092.821] GetTickCount () returned 0x114c208
	[0092.821] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0092.933] GetTickCount () returned 0x114c275
	[0092.933] GetTickCount () returned 0x114c275
	[0092.933] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0093.040] GetTickCount () returned 0x114c2e2
	[0093.040] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0093.258] GetTickCount () returned 0x114c3bd
	[0093.259] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0093.447] GetTickCount () returned 0x114c478
	[0093.447] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0094.585] GetTickCount () returned 0x114c8eb
	[0094.585] GetTickCount () returned 0x114c8eb
	[0094.585] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0095.165] GetTickCount () returned 0x114cb2c
	[0095.165] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0095.785] GetTickCount () returned 0x114cd9c
	[0095.785] GetTickCount () returned 0x114cd9c
	[0095.785] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0096.141] GetTickCount () returned 0x114cef3
	[0096.142] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0096.720] GetTickCount () returned 0x114d0e6
	[0096.720] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0097.418] GetTickCount () returned 0x114d395
	[0097.418] GetTickCount () returned 0x114d395
	[0097.418] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0097.736] GetTickCount () returned 0x114d4dc
	[0097.736] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0097.993] GetTickCount () returned 0x114d5d6
	[0097.993] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0098.244] GetTickCount () returned 0x114d6d0
	[0098.244] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0098.934] GetTickCount () returned 0x114d920
	[0098.934] GetTickCount () returned 0x114d920
	[0098.935] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0099.207] GetTickCount () returned 0x114da39
	[0099.207] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102
	[0099.639] GetTickCount () returned 0x114dbee
	[0099.639] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) 

Thread:
	id = 9
	os_tid = 0x23c

	[0072.487] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x36fa20
	[0072.488] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x37fa28
	[0072.488] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330aa0
	[0072.489] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a378
	[0072.489] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330ae8
	[0072.489] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x2ed0020
	[0072.491] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b00
	[0072.492] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b00, Size=0x20) returned 0x339858
	[0072.492] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b00
	[0072.492] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b00, Size=0x20) returned 0x339880
	[0072.493] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.494] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.494] Wow64DisableWow64FsRedirection (in: OldValue=0x28cff58 | out: OldValue=0x28cff58*=0x0) returned 1
	[0072.494] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.494] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339858 | out: hHeap=0x2e0000) returned 1
	[0072.494] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.495] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339880 | out: hHeap=0x2e0000) returned 1
	[0072.495] Sleep (dwMilliseconds=0x64) 
	[0072.931] lstrcmpiW (lpString1=".ini", lpString2=".lina") returned -1
	[0072.932] lstrlenW (lpString="desktop.ini") returned 11
	[0072.932] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0072.932] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=129) returned 1
	[0072.933] CloseHandle (hObject=0x180) returned 1
	[0072.933] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26
	[0072.933] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0072.933] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0072.934] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0072.934] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0072.934] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188
	[0072.936] GetLastError () returned 0x0
	[0072.936] ReadFile (in: hFile=0x180, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x81, lpOverlapped=0x0) returned 1
	[0072.947] WriteFile (in: hFile=0x188, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x90, lpOverlapped=0x0) returned 1
	[0072.948] ReadFile (in: hFile=0x180, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0072.949] WriteFile (in: hFile=0x188, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0072.949] SetEndOfFile (hFile=0x188) returned 1
	[0072.950] CloseHandle (hObject=0x188) returned 1
	[0072.952] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0072.952] SetEndOfFile (hFile=0x180) returned 1
	[0072.954] CloseHandle (hObject=0x180) returned 1
	[0072.954] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x26) returned 1
	[0072.955] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1
	[0072.956] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.956] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.956] lstrlenW (lpString=".doc") returned 4
	[0072.956] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0072.956] lstrlenW (lpString=".docx") returned 5
	[0072.957] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0072.957] lstrlenW (lpString=".pdf") returned 4
	[0072.957] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0072.957] lstrlenW (lpString=".xls") returned 4
	[0072.957] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0072.957] lstrlenW (lpString=".xlsx") returned 5
	[0072.957] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0072.958] lstrlenW (lpString=".ppt") returned 4
	[0072.958] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0072.958] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.958] lstrlenW (lpString=".zip") returned 4
	[0072.958] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0072.958] lstrlenW (lpString=".rar") returned 4
	[0072.959] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0072.959] lstrlenW (lpString=".bz2") returned 4
	[0072.959] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0072.959] lstrlenW (lpString=".7z") returned 3
	[0072.959] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0072.959] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.959] lstrlenW (lpString=".dbf") returned 4
	[0072.960] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0072.960] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.960] lstrlenW (lpString=".1cd") returned 4
	[0072.960] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0072.960] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.960] lstrlenW (lpString=".jpg") returned 4
	[0072.961] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0072.961] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.961] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.961] lstrlenW (lpString=".doc") returned 4
	[0072.962] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0072.962] lstrlenW (lpString=".docx") returned 5
	[0072.962] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0072.962] lstrlenW (lpString=".pdf") returned 4
	[0072.963] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0072.963] lstrlenW (lpString=".xls") returned 4
	[0072.963] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0072.963] lstrlenW (lpString=".xlsx") returned 5
	[0072.963] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0072.963] lstrlenW (lpString=".ppt") returned 4
	[0072.964] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0072.964] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.964] lstrlenW (lpString=".zip") returned 4
	[0072.964] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0072.964] lstrlenW (lpString=".rar") returned 4
	[0072.964] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0072.965] lstrlenW (lpString=".bz2") returned 4
	[0072.965] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0072.965] lstrlenW (lpString=".7z") returned 3
	[0072.965] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0072.965] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.965] lstrlenW (lpString=".dbf") returned 4
	[0072.966] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0072.966] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.966] lstrlenW (lpString=".1cd") returned 4
	[0072.966] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0072.966] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.966] lstrlenW (lpString=".jpg") returned 4
	[0072.967] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0072.968] Sleep (dwMilliseconds=0x64) 
	[0073.448] lstrcmpiW (lpString1=".LOG", lpString2=".lina") returned 1
	[0073.448] lstrlenW (lpString="BCD.LOG") returned 7
	[0073.448] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0073.448] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.449] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.449] lstrlenW (lpString=".doc") returned 4
	[0073.449] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0073.449] lstrlenW (lpString=".docx") returned 5
	[0073.449] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0073.449] lstrlenW (lpString=".pdf") returned 4
	[0073.450] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0073.450] lstrlenW (lpString=".xls") returned 4
	[0073.450] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0073.450] lstrlenW (lpString=".xlsx") returned 5
	[0073.450] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0073.450] lstrlenW (lpString=".ppt") returned 4
	[0073.450] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0073.451] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.451] lstrlenW (lpString=".zip") returned 4
	[0073.451] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0073.451] lstrlenW (lpString=".rar") returned 4
	[0073.451] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0073.451] lstrlenW (lpString=".bz2") returned 4
	[0073.452] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0073.452] lstrlenW (lpString=".7z") returned 3
	[0073.452] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0073.452] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.452] lstrlenW (lpString=".dbf") returned 4
	[0073.452] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0073.453] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.453] lstrlenW (lpString=".1cd") returned 4
	[0073.453] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0073.453] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.453] lstrlenW (lpString=".jpg") returned 4
	[0073.453] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0073.454] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.454] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.454] lstrlenW (lpString=".doc") returned 4
	[0073.454] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0073.454] lstrlenW (lpString=".docx") returned 5
	[0073.455] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0073.455] lstrlenW (lpString=".pdf") returned 4
	[0073.455] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0073.455] lstrlenW (lpString=".xls") returned 4
	[0073.455] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0073.455] lstrlenW (lpString=".xlsx") returned 5
	[0073.456] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0073.456] lstrlenW (lpString=".ppt") returned 4
	[0073.456] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0073.456] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.456] lstrlenW (lpString=".zip") returned 4
	[0073.456] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0073.456] lstrlenW (lpString=".rar") returned 4
	[0073.457] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0073.457] lstrlenW (lpString=".bz2") returned 4
	[0073.457] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0073.457] lstrlenW (lpString=".7z") returned 3
	[0073.457] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0073.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.458] lstrlenW (lpString=".dbf") returned 4
	[0073.458] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0073.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.458] lstrlenW (lpString=".1cd") returned 4
	[0073.458] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0073.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0073.458] lstrlenW (lpString=".jpg") returned 4
	[0073.459] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0073.460] lstrcmpiW (lpString1=".DAT", lpString2=".lina") returned -1
	[0073.460] lstrlenW (lpString="BOOTSTAT.DAT") returned 12
	[0073.460] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0074.870] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=65536) returned 1
	[0074.870] CloseHandle (hObject=0x190) returned 1
	[0074.870] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0074.871] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0074.871] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0074.871] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.871] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.872] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0074.873] GetLastError () returned 0x0
	[0074.873] ReadFile (in: hFile=0x190, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x10000, lpOverlapped=0x0) returned 1
	[0074.877] WriteFile (in: hFile=0x194, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x10010, lpOverlapped=0x0) returned 1
	[0074.882] ReadFile (in: hFile=0x190, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0074.882] WriteFile (in: hFile=0x194, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0074.882] SetEndOfFile (hFile=0x194) returned 1
	[0074.883] CloseHandle (hObject=0x194) returned 1
	[0074.886] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0074.886] SetEndOfFile (hFile=0x190) returned 1
	[0074.888] CloseHandle (hObject=0x190) returned 1
	[0074.889] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x26) returned 1
	[0074.890] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0074.890] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.891] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.891] lstrlenW (lpString=".doc") returned 4
	[0074.891] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0074.891] lstrlenW (lpString=".docx") returned 5
	[0074.891] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0074.892] lstrlenW (lpString=".pdf") returned 4
	[0074.892] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0074.892] lstrlenW (lpString=".xls") returned 4
	[0074.892] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0074.892] lstrlenW (lpString=".xlsx") returned 5
	[0074.892] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0074.893] lstrlenW (lpString=".ppt") returned 4
	[0074.893] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0074.893] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.893] lstrlenW (lpString=".zip") returned 4
	[0074.893] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0074.893] lstrlenW (lpString=".rar") returned 4
	[0074.893] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0074.894] lstrlenW (lpString=".bz2") returned 4
	[0074.894] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0074.894] lstrlenW (lpString=".7z") returned 3
	[0074.894] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0074.894] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.894] lstrlenW (lpString=".dbf") returned 4
	[0074.894] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0074.895] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.895] lstrlenW (lpString=".1cd") returned 4
	[0074.895] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0074.895] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.895] lstrlenW (lpString=".jpg") returned 4
	[0074.895] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0074.896] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.896] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.896] lstrlenW (lpString=".doc") returned 4
	[0074.896] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0074.897] lstrlenW (lpString=".docx") returned 5
	[0074.897] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0074.897] lstrlenW (lpString=".pdf") returned 4
	[0074.897] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0074.897] lstrlenW (lpString=".xls") returned 4
	[0074.897] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0074.897] lstrlenW (lpString=".xlsx") returned 5
	[0074.898] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0074.898] lstrlenW (lpString=".ppt") returned 4
	[0074.898] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0074.898] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.898] lstrlenW (lpString=".zip") returned 4
	[0074.899] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0074.899] lstrlenW (lpString=".rar") returned 4
	[0074.899] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0074.899] lstrlenW (lpString=".bz2") returned 4
	[0074.899] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0074.899] lstrlenW (lpString=".7z") returned 3
	[0074.899] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0074.900] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.900] lstrlenW (lpString=".dbf") returned 4
	[0074.900] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0074.900] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.900] lstrlenW (lpString=".1cd") returned 4
	[0074.900] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0074.901] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0074.901] lstrlenW (lpString=".jpg") returned 4
	[0074.901] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0074.902] Sleep (dwMilliseconds=0x64) 
	[0075.073] Sleep (dwMilliseconds=0x64) 
	[0075.273] Sleep (dwMilliseconds=0x64) 
	[0075.662] Sleep (dwMilliseconds=0x64) 
	[0075.926] Sleep (dwMilliseconds=0x64) 
	[0076.442] Sleep (dwMilliseconds=0x64) 
	[0076.644] Sleep (dwMilliseconds=0x64) 
	[0076.853] Sleep (dwMilliseconds=0x64) 
	[0077.121] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0077.121] lstrlenW (lpString="ExcelMUI.xml") returned 12
	[0077.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0077.956] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1565) returned 1
	[0077.957] CloseHandle (hObject=0x1c8) returned 1
	[0077.957] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020
	[0077.957] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0077.958] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.958] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.958] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0077.962] GetLastError () returned 0x0
	[0077.962] ReadFile (in: hFile=0x1c8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x61d, lpOverlapped=0x0) returned 1
	[0077.965] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x620, lpOverlapped=0x0) returned 1
	[0077.967] ReadFile (in: hFile=0x1c8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0077.967] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0077.967] SetEndOfFile (hFile=0x1e4) returned 1
	[0077.968] CloseHandle (hObject=0x1e4) returned 1
	[0077.973] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.973] SetEndOfFile (hFile=0x1c8) returned 1
	[0077.975] CloseHandle (hObject=0x1c8) returned 1
	[0077.975] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0077.976] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1
	[0077.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.977] lstrlenW (lpString=".doc") returned 4
	[0077.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0077.977] lstrlenW (lpString=".docx") returned 5
	[0077.977] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0077.978] lstrlenW (lpString=".pdf") returned 4
	[0077.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0077.978] lstrlenW (lpString=".xls") returned 4
	[0077.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0077.978] lstrlenW (lpString=".xlsx") returned 5
	[0077.978] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0077.979] lstrlenW (lpString=".ppt") returned 4
	[0077.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0077.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.979] lstrlenW (lpString=".zip") returned 4
	[0077.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0077.979] lstrlenW (lpString=".rar") returned 4
	[0077.980] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0077.980] lstrlenW (lpString=".bz2") returned 4
	[0077.980] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0077.980] lstrlenW (lpString=".7z") returned 3
	[0077.980] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0077.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.981] lstrlenW (lpString=".dbf") returned 4
	[0077.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0077.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.981] lstrlenW (lpString=".1cd") returned 4
	[0077.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0077.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.982] lstrlenW (lpString=".jpg") returned 4
	[0077.982] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0077.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.983] lstrlenW (lpString=".doc") returned 4
	[0077.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0077.983] lstrlenW (lpString=".docx") returned 5
	[0077.983] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0077.983] lstrlenW (lpString=".pdf") returned 4
	[0077.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0077.984] lstrlenW (lpString=".xls") returned 4
	[0077.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0077.984] lstrlenW (lpString=".xlsx") returned 5
	[0077.984] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0077.984] lstrlenW (lpString=".ppt") returned 4
	[0077.984] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0077.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.985] lstrlenW (lpString=".zip") returned 4
	[0077.985] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0077.985] lstrlenW (lpString=".rar") returned 4
	[0077.985] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0077.986] lstrlenW (lpString=".bz2") returned 4
	[0077.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0077.986] lstrlenW (lpString=".7z") returned 3
	[0077.986] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0077.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.986] lstrlenW (lpString=".dbf") returned 4
	[0077.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0077.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.987] lstrlenW (lpString=".1cd") returned 4
	[0077.987] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0077.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0077.987] lstrlenW (lpString=".jpg") returned 4
	[0077.988] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0077.990] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0077.990] lstrlenW (lpString="Setup.xml") returned 9
	[0077.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.252] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1608) returned 1
	[0078.281] CloseHandle (hObject=0x1ec) returned 1
	[0078.282] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0078.282] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.282] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.283] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0078.283] GetLastError () returned 0x0
	[0078.284] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x648, lpOverlapped=0x0) returned 1
	[0078.286] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x650, lpOverlapped=0x0) returned 1
	[0078.288] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.288] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.288] SetEndOfFile (hFile=0x1f0) returned 1
	[0078.289] CloseHandle (hObject=0x1f0) returned 1
	[0078.292] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.292] SetEndOfFile (hFile=0x1ec) returned 1
	[0078.294] CloseHandle (hObject=0x1ec) returned 1
	[0078.294] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.295] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0078.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.296] lstrlenW (lpString=".doc") returned 4
	[0078.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.296] lstrlenW (lpString=".docx") returned 5
	[0078.296] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.296] lstrlenW (lpString=".pdf") returned 4
	[0078.296] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.297] lstrlenW (lpString=".xls") returned 4
	[0078.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.297] lstrlenW (lpString=".xlsx") returned 5
	[0078.298] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.298] lstrlenW (lpString=".ppt") returned 4
	[0078.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.298] lstrlenW (lpString=".zip") returned 4
	[0078.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.298] lstrlenW (lpString=".rar") returned 4
	[0078.299] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.299] lstrlenW (lpString=".bz2") returned 4
	[0078.299] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.299] lstrlenW (lpString=".7z") returned 3
	[0078.299] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.299] lstrlenW (lpString=".dbf") returned 4
	[0078.300] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.300] lstrlenW (lpString=".1cd") returned 4
	[0078.300] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.300] lstrlenW (lpString=".jpg") returned 4
	[0078.300] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.301] lstrlenW (lpString=".doc") returned 4
	[0078.301] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.301] lstrlenW (lpString=".docx") returned 5
	[0078.301] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.301] lstrlenW (lpString=".pdf") returned 4
	[0078.302] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.302] lstrlenW (lpString=".xls") returned 4
	[0078.302] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.302] lstrlenW (lpString=".xlsx") returned 5
	[0078.302] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.302] lstrlenW (lpString=".ppt") returned 4
	[0078.302] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.303] lstrlenW (lpString=".zip") returned 4
	[0078.303] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.303] lstrlenW (lpString=".rar") returned 4
	[0078.303] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.303] lstrlenW (lpString=".bz2") returned 4
	[0078.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.304] lstrlenW (lpString=".7z") returned 3
	[0078.304] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.304] lstrlenW (lpString=".dbf") returned 4
	[0078.304] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.304] lstrlenW (lpString=".1cd") returned 4
	[0078.305] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.305] lstrlenW (lpString=".jpg") returned 4
	[0078.305] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.306] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.306] lstrlenW (lpString="Setup.xml") returned 9
	[0078.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.307] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=4207) returned 1
	[0078.307] CloseHandle (hObject=0x1ec) returned 1
	[0078.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0078.308] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.308] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.308] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0078.309] GetLastError () returned 0x0
	[0078.309] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x106f, lpOverlapped=0x0) returned 1
	[0078.315] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0078.317] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.317] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.317] SetEndOfFile (hFile=0x1f0) returned 1
	[0078.318] CloseHandle (hObject=0x1f0) returned 1
	[0078.320] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.320] SetEndOfFile (hFile=0x1ec) returned 1
	[0078.322] CloseHandle (hObject=0x1ec) returned 1
	[0078.322] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.323] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0078.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.324] lstrlenW (lpString=".doc") returned 4
	[0078.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.325] lstrlenW (lpString=".docx") returned 5
	[0078.325] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.325] lstrlenW (lpString=".pdf") returned 4
	[0078.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.325] lstrlenW (lpString=".xls") returned 4
	[0078.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.325] lstrlenW (lpString=".xlsx") returned 5
	[0078.326] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.326] lstrlenW (lpString=".ppt") returned 4
	[0078.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.326] lstrlenW (lpString=".zip") returned 4
	[0078.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.326] lstrlenW (lpString=".rar") returned 4
	[0078.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.327] lstrlenW (lpString=".bz2") returned 4
	[0078.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.327] lstrlenW (lpString=".7z") returned 3
	[0078.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.327] lstrlenW (lpString=".dbf") returned 4
	[0078.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.357] lstrlenW (lpString=".1cd") returned 4
	[0078.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.358] lstrlenW (lpString=".jpg") returned 4
	[0078.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.358] lstrlenW (lpString=".doc") returned 4
	[0078.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.359] lstrlenW (lpString=".docx") returned 5
	[0078.359] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.359] lstrlenW (lpString=".pdf") returned 4
	[0078.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.359] lstrlenW (lpString=".xls") returned 4
	[0078.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.359] lstrlenW (lpString=".xlsx") returned 5
	[0078.360] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.360] lstrlenW (lpString=".ppt") returned 4
	[0078.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.360] lstrlenW (lpString=".zip") returned 4
	[0078.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.360] lstrlenW (lpString=".rar") returned 4
	[0078.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.360] lstrlenW (lpString=".bz2") returned 4
	[0078.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.361] lstrlenW (lpString=".7z") returned 3
	[0078.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.361] lstrlenW (lpString=".dbf") returned 4
	[0078.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.361] lstrlenW (lpString=".1cd") returned 4
	[0078.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.362] lstrlenW (lpString=".jpg") returned 4
	[0078.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.363] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.363] lstrlenW (lpString="Proof.xml") returned 9
	[0078.363] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0078.651] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1347) returned 1
	[0078.651] CloseHandle (hObject=0x1fc) returned 1
	[0078.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020
	[0078.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0078.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.654] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0078.655] GetLastError () returned 0x0
	[0078.655] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x543, lpOverlapped=0x0) returned 1
	[0078.933] WriteFile (in: hFile=0x200, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x550, lpOverlapped=0x0) returned 1
	[0078.935] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.935] WriteFile (in: hFile=0x200, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.935] SetEndOfFile (hFile=0x200) returned 1
	[0078.936] CloseHandle (hObject=0x200) returned 1
	[0078.940] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.940] SetEndOfFile (hFile=0x1fc) returned 1
	[0078.942] CloseHandle (hObject=0x1fc) returned 1
	[0078.942] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.943] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1
	[0078.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.944] lstrlenW (lpString=".doc") returned 4
	[0078.944] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.944] lstrlenW (lpString=".docx") returned 5
	[0078.945] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0078.945] lstrlenW (lpString=".pdf") returned 4
	[0078.945] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.945] lstrlenW (lpString=".xls") returned 4
	[0078.945] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.945] lstrlenW (lpString=".xlsx") returned 5
	[0078.945] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0078.946] lstrlenW (lpString=".ppt") returned 4
	[0078.946] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.946] lstrlenW (lpString=".zip") returned 4
	[0078.946] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.946] lstrlenW (lpString=".rar") returned 4
	[0078.947] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.947] lstrlenW (lpString=".bz2") returned 4
	[0078.947] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.947] lstrlenW (lpString=".7z") returned 3
	[0078.947] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.948] lstrlenW (lpString=".dbf") returned 4
	[0078.948] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.948] lstrlenW (lpString=".1cd") returned 4
	[0078.948] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.949] lstrlenW (lpString=".jpg") returned 4
	[0078.949] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.949] lstrlenW (lpString=".doc") returned 4
	[0078.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.950] lstrlenW (lpString=".docx") returned 5
	[0078.950] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0078.950] lstrlenW (lpString=".pdf") returned 4
	[0078.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.950] lstrlenW (lpString=".xls") returned 4
	[0078.951] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.951] lstrlenW (lpString=".xlsx") returned 5
	[0078.951] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0078.951] lstrlenW (lpString=".ppt") returned 4
	[0078.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.952] lstrlenW (lpString=".zip") returned 4
	[0078.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.953] lstrlenW (lpString=".rar") returned 4
	[0078.953] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.953] lstrlenW (lpString=".bz2") returned 4
	[0078.953] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.953] lstrlenW (lpString=".7z") returned 3
	[0078.953] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.954] lstrlenW (lpString=".dbf") returned 4
	[0078.954] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.954] lstrlenW (lpString=".1cd") returned 4
	[0078.954] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0078.955] lstrlenW (lpString=".jpg") returned 4
	[0078.955] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.956] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.956] lstrlenW (lpString="Office32MUI.xml") returned 15
	[0078.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0078.958] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1383) returned 1
	[0078.958] CloseHandle (hObject=0x1fc) returned 1
	[0078.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020
	[0078.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0078.960] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.960] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.960] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0078.961] GetLastError () returned 0x0
	[0078.961] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x567, lpOverlapped=0x0) returned 1
	[0079.124] WriteFile (in: hFile=0x200, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x570, lpOverlapped=0x0) returned 1
	[0079.126] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.126] WriteFile (in: hFile=0x200, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0079.126] SetEndOfFile (hFile=0x200) returned 1
	[0079.127] CloseHandle (hObject=0x200) returned 1
	[0079.133] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.133] SetEndOfFile (hFile=0x1fc) returned 1
	[0079.135] CloseHandle (hObject=0x1fc) returned 1
	[0079.135] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.136] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1
	[0079.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.137] lstrlenW (lpString=".doc") returned 4
	[0079.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.137] lstrlenW (lpString=".docx") returned 5
	[0079.137] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0079.137] lstrlenW (lpString=".pdf") returned 4
	[0079.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.137] lstrlenW (lpString=".xls") returned 4
	[0079.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.138] lstrlenW (lpString=".xlsx") returned 5
	[0079.138] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0079.138] lstrlenW (lpString=".ppt") returned 4
	[0079.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.139] lstrlenW (lpString=".zip") returned 4
	[0079.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.139] lstrlenW (lpString=".rar") returned 4
	[0079.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.139] lstrlenW (lpString=".bz2") returned 4
	[0079.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.139] lstrlenW (lpString=".7z") returned 3
	[0079.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.140] lstrlenW (lpString=".dbf") returned 4
	[0079.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.140] lstrlenW (lpString=".1cd") returned 4
	[0079.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.141] lstrlenW (lpString=".jpg") returned 4
	[0079.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.394] lstrlenW (lpString=".doc") returned 4
	[0079.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.394] lstrlenW (lpString=".docx") returned 5
	[0079.394] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0079.394] lstrlenW (lpString=".pdf") returned 4
	[0079.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.395] lstrlenW (lpString=".xls") returned 4
	[0079.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.395] lstrlenW (lpString=".xlsx") returned 5
	[0079.395] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0079.395] lstrlenW (lpString=".ppt") returned 4
	[0079.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.396] lstrlenW (lpString=".zip") returned 4
	[0079.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.396] lstrlenW (lpString=".rar") returned 4
	[0079.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.396] lstrlenW (lpString=".bz2") returned 4
	[0079.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.397] lstrlenW (lpString=".7z") returned 3
	[0079.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.397] lstrlenW (lpString=".dbf") returned 4
	[0079.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.398] lstrlenW (lpString=".1cd") returned 4
	[0079.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0079.398] lstrlenW (lpString=".jpg") returned 4
	[0079.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.399] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0079.400] lstrlenW (lpString="Setup.xml") returned 9
	[0079.400] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0079.624] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=6241) returned 1
	[0079.624] CloseHandle (hObject=0x1ec) returned 1
	[0079.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0079.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0079.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0079.625] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.625] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0079.628] GetLastError () returned 0x0
	[0079.628] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x1861, lpOverlapped=0x0) returned 1
	[0079.631] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0079.633] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.633] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0079.633] SetEndOfFile (hFile=0x1f0) returned 1
	[0079.634] CloseHandle (hObject=0x1f0) returned 1
	[0079.636] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.636] SetEndOfFile (hFile=0x1ec) returned 1
	[0079.638] CloseHandle (hObject=0x1ec) returned 1
	[0079.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.646] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0079.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.647] lstrlenW (lpString=".doc") returned 4
	[0079.648] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.648] lstrlenW (lpString=".docx") returned 5
	[0079.648] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.648] lstrlenW (lpString=".pdf") returned 4
	[0079.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.648] lstrlenW (lpString=".xls") returned 4
	[0079.649] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.649] lstrlenW (lpString=".xlsx") returned 5
	[0079.649] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.649] lstrlenW (lpString=".ppt") returned 4
	[0079.649] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.650] lstrlenW (lpString=".zip") returned 4
	[0079.650] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.650] lstrlenW (lpString=".rar") returned 4
	[0079.650] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.651] lstrlenW (lpString=".bz2") returned 4
	[0079.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.651] lstrlenW (lpString=".7z") returned 3
	[0079.651] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.651] lstrlenW (lpString=".dbf") returned 4
	[0079.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.652] lstrlenW (lpString=".1cd") returned 4
	[0079.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.653] lstrlenW (lpString=".jpg") returned 4
	[0079.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.654] lstrlenW (lpString=".doc") returned 4
	[0079.654] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.654] lstrlenW (lpString=".docx") returned 5
	[0079.654] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.655] lstrlenW (lpString=".pdf") returned 4
	[0079.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.655] lstrlenW (lpString=".xls") returned 4
	[0079.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.655] lstrlenW (lpString=".xlsx") returned 5
	[0079.656] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.656] lstrlenW (lpString=".ppt") returned 4
	[0079.656] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.656] lstrlenW (lpString=".zip") returned 4
	[0079.656] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.657] lstrlenW (lpString=".rar") returned 4
	[0079.657] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.657] lstrlenW (lpString=".bz2") returned 4
	[0079.657] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.657] lstrlenW (lpString=".7z") returned 3
	[0079.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.658] lstrlenW (lpString=".dbf") returned 4
	[0079.658] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.658] lstrlenW (lpString=".1cd") returned 4
	[0079.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.659] lstrlenW (lpString=".jpg") returned 4
	[0079.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.660] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0079.660] lstrlenW (lpString="OneNoteMUI.xml") returned 14
	[0079.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0079.663] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1606) returned 1
	[0079.663] CloseHandle (hObject=0x1ec) returned 1
	[0079.663] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020
	[0079.663] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0079.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0079.664] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.664] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.665] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0079.665] GetLastError () returned 0x0
	[0079.666] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x646, lpOverlapped=0x0) returned 1
	[0080.144] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x650, lpOverlapped=0x0) returned 1
	[0080.145] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.146] WriteFile (in: hFile=0x1f0, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0080.146] SetEndOfFile (hFile=0x1f0) returned 1
	[0080.147] CloseHandle (hObject=0x1f0) returned 1
	[0080.152] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.152] SetEndOfFile (hFile=0x1ec) returned 1
	[0080.167] CloseHandle (hObject=0x1ec) returned 1
	[0080.167] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.168] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1
	[0080.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.370] lstrlenW (lpString=".doc") returned 4
	[0080.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.370] lstrlenW (lpString=".docx") returned 5
	[0080.370] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.371] lstrlenW (lpString=".pdf") returned 4
	[0080.371] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.371] lstrlenW (lpString=".xls") returned 4
	[0080.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.371] lstrlenW (lpString=".xlsx") returned 5
	[0080.372] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.372] lstrlenW (lpString=".ppt") returned 4
	[0080.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.373] lstrlenW (lpString=".zip") returned 4
	[0080.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.373] lstrlenW (lpString=".rar") returned 4
	[0080.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.373] lstrlenW (lpString=".bz2") returned 4
	[0080.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.374] lstrlenW (lpString=".7z") returned 3
	[0080.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.374] lstrlenW (lpString=".dbf") returned 4
	[0080.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.375] lstrlenW (lpString=".1cd") returned 4
	[0080.375] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.375] lstrlenW (lpString=".jpg") returned 4
	[0080.375] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.376] lstrlenW (lpString=".doc") returned 4
	[0080.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.376] lstrlenW (lpString=".docx") returned 5
	[0080.376] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.377] lstrlenW (lpString=".pdf") returned 4
	[0080.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.377] lstrlenW (lpString=".xls") returned 4
	[0080.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.377] lstrlenW (lpString=".xlsx") returned 5
	[0080.377] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.378] lstrlenW (lpString=".ppt") returned 4
	[0080.378] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.378] lstrlenW (lpString=".zip") returned 4
	[0080.378] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.378] lstrlenW (lpString=".rar") returned 4
	[0080.379] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.379] lstrlenW (lpString=".bz2") returned 4
	[0080.379] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.379] lstrlenW (lpString=".7z") returned 3
	[0080.379] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.380] lstrlenW (lpString=".dbf") returned 4
	[0080.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.380] lstrlenW (lpString=".1cd") returned 4
	[0080.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0080.381] lstrlenW (lpString=".jpg") returned 4
	[0080.381] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.382] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0080.382] lstrlenW (lpString="branding.xml") returned 12
	[0080.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0080.384] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=596341) returned 1
	[0080.384] CloseHandle (hObject=0x1c8) returned 1
	[0080.384] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020
	[0080.384] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0080.385] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.385] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0080.386] GetLastError () returned 0x0
	[0080.386] ReadFile (in: hFile=0x1c8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x91975, lpOverlapped=0x0) returned 1
	[0080.439] WriteFile (in: hFile=0x1fc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0080.705] ReadFile (in: hFile=0x1c8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.705] WriteFile (in: hFile=0x1fc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0080.706] SetEndOfFile (hFile=0x1fc) returned 1
	[0080.706] CloseHandle (hObject=0x1fc) returned 1
	[0080.714] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.714] SetEndOfFile (hFile=0x1c8) returned 1
	[0080.723] CloseHandle (hObject=0x1c8) returned 1
	[0080.723] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.724] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1
	[0080.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.724] lstrlenW (lpString=".doc") returned 4
	[0080.725] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.725] lstrlenW (lpString=".docx") returned 5
	[0080.725] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0080.725] lstrlenW (lpString=".pdf") returned 4
	[0080.725] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.725] lstrlenW (lpString=".xls") returned 4
	[0080.725] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.726] lstrlenW (lpString=".xlsx") returned 5
	[0080.726] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0080.726] lstrlenW (lpString=".ppt") returned 4
	[0080.726] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.726] lstrlenW (lpString=".zip") returned 4
	[0080.726] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.727] lstrlenW (lpString=".rar") returned 4
	[0080.727] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.727] lstrlenW (lpString=".bz2") returned 4
	[0080.727] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.727] lstrlenW (lpString=".7z") returned 3
	[0080.727] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.728] lstrlenW (lpString=".dbf") returned 4
	[0080.728] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.728] lstrlenW (lpString=".1cd") returned 4
	[0080.728] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.729] lstrlenW (lpString=".jpg") returned 4
	[0080.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.729] lstrlenW (lpString=".doc") returned 4
	[0080.730] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.730] lstrlenW (lpString=".docx") returned 5
	[0080.730] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0080.730] lstrlenW (lpString=".pdf") returned 4
	[0080.730] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.771] lstrlenW (lpString=".xls") returned 4
	[0080.771] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.771] lstrlenW (lpString=".xlsx") returned 5
	[0080.771] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0080.772] lstrlenW (lpString=".ppt") returned 4
	[0080.772] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.772] lstrlenW (lpString=".zip") returned 4
	[0080.772] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.772] lstrlenW (lpString=".rar") returned 4
	[0080.773] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.773] lstrlenW (lpString=".bz2") returned 4
	[0080.773] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.773] lstrlenW (lpString=".7z") returned 3
	[0080.773] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.774] lstrlenW (lpString=".dbf") returned 4
	[0080.774] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.774] lstrlenW (lpString=".1cd") returned 4
	[0080.774] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0080.775] lstrlenW (lpString=".jpg") returned 4
	[0080.775] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.776] lstrcmpiW (lpString1=".chm", lpString2=".lina") returned -1
	[0080.776] lstrlenW (lpString="pss10r.chm") returned 10
	[0080.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0081.095] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=27195) returned 1
	[0081.095] CloseHandle (hObject=0x20c) returned 1
	[0081.096] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020
	[0081.096] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0081.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0081.096] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.097] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0081.097] GetLastError () returned 0x0
	[0081.098] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0083.503] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0083.505] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.505] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0083.505] SetEndOfFile (hFile=0x210) returned 1
	[0083.506] CloseHandle (hObject=0x210) returned 1
	[0083.508] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.508] SetEndOfFile (hFile=0x20c) returned 1
	[0083.510] CloseHandle (hObject=0x20c) returned 1
	[0083.510] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0083.510] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1
	[0083.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.511] lstrlenW (lpString=".doc") returned 4
	[0083.511] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0083.511] lstrlenW (lpString=".docx") returned 5
	[0083.512] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0083.512] lstrlenW (lpString=".pdf") returned 4
	[0083.512] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0083.512] lstrlenW (lpString=".xls") returned 4
	[0083.512] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0083.512] lstrlenW (lpString=".xlsx") returned 5
	[0083.512] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0083.512] lstrlenW (lpString=".ppt") returned 4
	[0083.512] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0083.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.513] lstrlenW (lpString=".zip") returned 4
	[0083.513] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0083.513] lstrlenW (lpString=".rar") returned 4
	[0083.513] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0083.513] lstrlenW (lpString=".bz2") returned 4
	[0083.513] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0083.513] lstrlenW (lpString=".7z") returned 3
	[0083.513] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0083.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.514] lstrlenW (lpString=".dbf") returned 4
	[0083.514] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0083.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.514] lstrlenW (lpString=".1cd") returned 4
	[0083.514] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0083.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.514] lstrlenW (lpString=".jpg") returned 4
	[0083.514] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0083.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.515] lstrlenW (lpString=".doc") returned 4
	[0083.515] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0083.515] lstrlenW (lpString=".docx") returned 5
	[0083.515] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0083.516] lstrlenW (lpString=".pdf") returned 4
	[0083.516] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0083.516] lstrlenW (lpString=".xls") returned 4
	[0083.516] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0083.516] lstrlenW (lpString=".xlsx") returned 5
	[0083.516] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0083.516] lstrlenW (lpString=".ppt") returned 4
	[0083.516] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0083.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.517] lstrlenW (lpString=".zip") returned 4
	[0083.517] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0083.517] lstrlenW (lpString=".rar") returned 4
	[0083.517] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0083.517] lstrlenW (lpString=".bz2") returned 4
	[0083.517] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0083.517] lstrlenW (lpString=".7z") returned 3
	[0083.517] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0083.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.518] lstrlenW (lpString=".dbf") returned 4
	[0083.518] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0083.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.518] lstrlenW (lpString=".1cd") returned 4
	[0083.518] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0083.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0083.518] lstrlenW (lpString=".jpg") returned 4
	[0083.518] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0083.519] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0083.519] lstrlenW (lpString="AccessMUISet.xml") returned 16
	[0083.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0083.520] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=819) returned 1
	[0083.520] CloseHandle (hObject=0x20c) returned 1
	[0083.520] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020
	[0083.521] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0083.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0083.521] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.521] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0083.522] GetLastError () returned 0x0
	[0083.522] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x333, lpOverlapped=0x0) returned 1
	[0084.924] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x340, lpOverlapped=0x0) returned 1
	[0085.786] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.787] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0085.787] SetEndOfFile (hFile=0x210) returned 1
	[0085.787] CloseHandle (hObject=0x210) returned 1
	[0085.792] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.792] SetEndOfFile (hFile=0x20c) returned 1
	[0085.794] CloseHandle (hObject=0x20c) returned 1
	[0085.797] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.797] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1
	[0085.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.798] lstrlenW (lpString=".doc") returned 4
	[0085.798] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.798] lstrlenW (lpString=".docx") returned 5
	[0085.798] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0085.799] lstrlenW (lpString=".pdf") returned 4
	[0085.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.799] lstrlenW (lpString=".xls") returned 4
	[0085.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.799] lstrlenW (lpString=".xlsx") returned 5
	[0085.799] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0085.799] lstrlenW (lpString=".ppt") returned 4
	[0085.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.800] lstrlenW (lpString=".zip") returned 4
	[0085.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.800] lstrlenW (lpString=".rar") returned 4
	[0085.800] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.800] lstrlenW (lpString=".bz2") returned 4
	[0085.800] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.801] lstrlenW (lpString=".7z") returned 3
	[0085.801] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.801] lstrlenW (lpString=".dbf") returned 4
	[0085.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.801] lstrlenW (lpString=".1cd") returned 4
	[0085.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.802] lstrlenW (lpString=".jpg") returned 4
	[0085.802] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.802] lstrlenW (lpString=".doc") returned 4
	[0085.802] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.802] lstrlenW (lpString=".docx") returned 5
	[0085.803] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0085.803] lstrlenW (lpString=".pdf") returned 4
	[0085.803] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.803] lstrlenW (lpString=".xls") returned 4
	[0085.803] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.803] lstrlenW (lpString=".xlsx") returned 5
	[0085.803] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0085.803] lstrlenW (lpString=".ppt") returned 4
	[0085.804] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.804] lstrlenW (lpString=".zip") returned 4
	[0085.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.804] lstrlenW (lpString=".rar") returned 4
	[0085.804] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.804] lstrlenW (lpString=".bz2") returned 4
	[0085.804] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.805] lstrlenW (lpString=".7z") returned 3
	[0085.805] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.805] lstrlenW (lpString=".dbf") returned 4
	[0085.805] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.805] lstrlenW (lpString=".1cd") returned 4
	[0085.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0085.806] lstrlenW (lpString=".jpg") returned 4
	[0085.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.806] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0085.806] lstrlenW (lpString="Office32WW.xml") returned 14
	[0085.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0085.808] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=4274) returned 1
	[0085.808] CloseHandle (hObject=0x20c) returned 1
	[0085.808] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0085.809] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0085.809] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.809] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0085.810] GetLastError () returned 0x0
	[0085.810] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0085.845] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0085.847] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.847] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.847] SetEndOfFile (hFile=0x210) returned 1
	[0085.849] CloseHandle (hObject=0x210) returned 1
	[0085.852] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.853] SetEndOfFile (hFile=0x20c) returned 1
	[0085.857] CloseHandle (hObject=0x20c) returned 1
	[0085.857] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.858] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0085.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.859] lstrlenW (lpString=".doc") returned 4
	[0085.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.859] lstrlenW (lpString=".docx") returned 5
	[0085.859] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.859] lstrlenW (lpString=".pdf") returned 4
	[0085.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.860] lstrlenW (lpString=".xls") returned 4
	[0085.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.860] lstrlenW (lpString=".xlsx") returned 5
	[0085.860] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.860] lstrlenW (lpString=".ppt") returned 4
	[0085.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.861] lstrlenW (lpString=".zip") returned 4
	[0085.861] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.861] lstrlenW (lpString=".rar") returned 4
	[0085.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.861] lstrlenW (lpString=".bz2") returned 4
	[0085.861] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.861] lstrlenW (lpString=".7z") returned 3
	[0085.861] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.862] lstrlenW (lpString=".dbf") returned 4
	[0085.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.862] lstrlenW (lpString=".1cd") returned 4
	[0085.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.862] lstrlenW (lpString=".jpg") returned 4
	[0085.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.864] lstrlenW (lpString=".doc") returned 4
	[0085.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.864] lstrlenW (lpString=".docx") returned 5
	[0085.864] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.864] lstrlenW (lpString=".pdf") returned 4
	[0085.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.864] lstrlenW (lpString=".xls") returned 4
	[0085.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.865] lstrlenW (lpString=".xlsx") returned 5
	[0085.865] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.865] lstrlenW (lpString=".ppt") returned 4
	[0085.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.865] lstrlenW (lpString=".zip") returned 4
	[0085.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.865] lstrlenW (lpString=".rar") returned 4
	[0085.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.866] lstrlenW (lpString=".bz2") returned 4
	[0085.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.866] lstrlenW (lpString=".7z") returned 3
	[0085.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.866] lstrlenW (lpString=".dbf") returned 4
	[0085.867] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.867] lstrlenW (lpString=".1cd") returned 4
	[0085.867] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.867] lstrlenW (lpString=".jpg") returned 4
	[0085.867] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.868] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0085.868] lstrlenW (lpString="Setup.xml") returned 9
	[0085.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0085.869] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=16683) returned 1
	[0085.869] CloseHandle (hObject=0x20c) returned 1
	[0085.869] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0085.869] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0085.870] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.870] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0085.871] GetLastError () returned 0x0
	[0085.871] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x412b, lpOverlapped=0x0) returned 1
	[0085.878] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0085.881] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.882] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.882] SetEndOfFile (hFile=0x210) returned 1
	[0085.882] CloseHandle (hObject=0x210) returned 1
	[0085.884] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.884] SetEndOfFile (hFile=0x20c) returned 1
	[0085.886] CloseHandle (hObject=0x20c) returned 1
	[0085.886] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.887] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0085.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.888] lstrlenW (lpString=".doc") returned 4
	[0085.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.889] lstrlenW (lpString=".docx") returned 5
	[0085.889] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0085.889] lstrlenW (lpString=".pdf") returned 4
	[0085.889] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.889] lstrlenW (lpString=".xls") returned 4
	[0085.889] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.890] lstrlenW (lpString=".xlsx") returned 5
	[0085.938] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0085.939] lstrlenW (lpString=".ppt") returned 4
	[0085.939] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.939] lstrlenW (lpString=".zip") returned 4
	[0085.939] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.939] lstrlenW (lpString=".rar") returned 4
	[0085.939] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.939] lstrlenW (lpString=".bz2") returned 4
	[0085.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.940] lstrlenW (lpString=".7z") returned 3
	[0085.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.940] lstrlenW (lpString=".dbf") returned 4
	[0085.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.940] lstrlenW (lpString=".1cd") returned 4
	[0085.940] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.941] lstrlenW (lpString=".jpg") returned 4
	[0085.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.941] lstrlenW (lpString=".doc") returned 4
	[0085.942] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.942] lstrlenW (lpString=".docx") returned 5
	[0085.942] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0085.942] lstrlenW (lpString=".pdf") returned 4
	[0085.942] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.942] lstrlenW (lpString=".xls") returned 4
	[0085.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.942] lstrlenW (lpString=".xlsx") returned 5
	[0085.942] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0085.943] lstrlenW (lpString=".ppt") returned 4
	[0085.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.943] lstrlenW (lpString=".zip") returned 4
	[0085.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.943] lstrlenW (lpString=".rar") returned 4
	[0085.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.944] lstrlenW (lpString=".bz2") returned 4
	[0085.944] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.944] lstrlenW (lpString=".7z") returned 3
	[0085.944] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.944] lstrlenW (lpString=".dbf") returned 4
	[0085.944] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.945] lstrlenW (lpString=".1cd") returned 4
	[0085.945] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.945] lstrlenW (lpString=".jpg") returned 4
	[0085.945] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.946] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0085.946] lstrlenW (lpString="Setup.xml") returned 9
	[0085.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0085.947] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=20577) returned 1
	[0085.947] CloseHandle (hObject=0x20c) returned 1
	[0085.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0085.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0085.948] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.948] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0085.953] GetLastError () returned 0x0
	[0085.953] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x5061, lpOverlapped=0x0) returned 1
	[0085.973] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0085.975] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.975] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.976] SetEndOfFile (hFile=0x210) returned 1
	[0085.976] CloseHandle (hObject=0x210) returned 1
	[0085.980] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.980] SetEndOfFile (hFile=0x20c) returned 1
	[0085.982] CloseHandle (hObject=0x20c) returned 1
	[0085.982] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.983] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0085.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.983] lstrlenW (lpString=".doc") returned 4
	[0085.984] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.984] lstrlenW (lpString=".docx") returned 5
	[0085.984] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0085.984] lstrlenW (lpString=".pdf") returned 4
	[0085.984] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.984] lstrlenW (lpString=".xls") returned 4
	[0085.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.985] lstrlenW (lpString=".xlsx") returned 5
	[0085.985] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0085.985] lstrlenW (lpString=".ppt") returned 4
	[0085.985] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.985] lstrlenW (lpString=".zip") returned 4
	[0085.985] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.985] lstrlenW (lpString=".rar") returned 4
	[0085.986] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.986] lstrlenW (lpString=".bz2") returned 4
	[0085.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.986] lstrlenW (lpString=".7z") returned 3
	[0085.986] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.986] lstrlenW (lpString=".dbf") returned 4
	[0085.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.987] lstrlenW (lpString=".1cd") returned 4
	[0085.987] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.987] lstrlenW (lpString=".jpg") returned 4
	[0085.987] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.989] lstrlenW (lpString=".doc") returned 4
	[0085.989] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.989] lstrlenW (lpString=".docx") returned 5
	[0085.989] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0085.989] lstrlenW (lpString=".pdf") returned 4
	[0085.989] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.990] lstrlenW (lpString=".xls") returned 4
	[0085.990] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.990] lstrlenW (lpString=".xlsx") returned 5
	[0085.990] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0085.990] lstrlenW (lpString=".ppt") returned 4
	[0085.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.991] lstrlenW (lpString=".zip") returned 4
	[0085.991] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.991] lstrlenW (lpString=".rar") returned 4
	[0085.991] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.991] lstrlenW (lpString=".bz2") returned 4
	[0085.991] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.991] lstrlenW (lpString=".7z") returned 3
	[0085.992] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.992] lstrlenW (lpString=".dbf") returned 4
	[0085.992] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.992] lstrlenW (lpString=".1cd") returned 4
	[0085.992] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.993] lstrlenW (lpString=".jpg") returned 4
	[0085.993] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.994] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0085.994] lstrlenW (lpString="VisiorWW.xml") returned 12
	[0085.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0086.116] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=8723) returned 1
	[0086.116] CloseHandle (hObject=0x1e8) returned 1
	[0086.116] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020
	[0086.116] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0086.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0086.117] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.117] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0086.118] GetLastError () returned 0x0
	[0086.118] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x2213, lpOverlapped=0x0) returned 1
	[0086.178] WriteFile (in: hFile=0x1ec, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x2220, lpOverlapped=0x0) returned 1
	[0086.180] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.180] WriteFile (in: hFile=0x1ec, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.181] SetEndOfFile (hFile=0x1ec) returned 1
	[0086.181] CloseHandle (hObject=0x1ec) returned 1
	[0086.183] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.183] SetEndOfFile (hFile=0x1e8) returned 1
	[0086.185] CloseHandle (hObject=0x1e8) returned 1
	[0086.188] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0086.189] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1
	[0086.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.189] lstrlenW (lpString=".doc") returned 4
	[0086.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0086.190] lstrlenW (lpString=".docx") returned 5
	[0086.190] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0086.190] lstrlenW (lpString=".pdf") returned 4
	[0086.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0086.191] lstrlenW (lpString=".xls") returned 4
	[0086.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0086.191] lstrlenW (lpString=".xlsx") returned 5
	[0086.191] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0086.191] lstrlenW (lpString=".ppt") returned 4
	[0086.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0086.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.191] lstrlenW (lpString=".zip") returned 4
	[0086.192] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0086.192] lstrlenW (lpString=".rar") returned 4
	[0086.192] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0086.192] lstrlenW (lpString=".bz2") returned 4
	[0086.192] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0086.192] lstrlenW (lpString=".7z") returned 3
	[0086.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0086.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.193] lstrlenW (lpString=".dbf") returned 4
	[0086.193] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0086.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.194] lstrlenW (lpString=".1cd") returned 4
	[0086.194] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0086.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.194] lstrlenW (lpString=".jpg") returned 4
	[0086.194] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0086.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.195] lstrlenW (lpString=".doc") returned 4
	[0086.195] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0086.195] lstrlenW (lpString=".docx") returned 5
	[0086.195] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0086.195] lstrlenW (lpString=".pdf") returned 4
	[0086.195] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0086.195] lstrlenW (lpString=".xls") returned 4
	[0086.195] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0086.196] lstrlenW (lpString=".xlsx") returned 5
	[0086.196] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0086.196] lstrlenW (lpString=".ppt") returned 4
	[0086.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0086.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.196] lstrlenW (lpString=".zip") returned 4
	[0086.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0086.196] lstrlenW (lpString=".rar") returned 4
	[0086.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0086.197] lstrlenW (lpString=".bz2") returned 4
	[0086.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0086.197] lstrlenW (lpString=".7z") returned 3
	[0086.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0086.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.197] lstrlenW (lpString=".dbf") returned 4
	[0086.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0086.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.197] lstrlenW (lpString=".1cd") returned 4
	[0086.198] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0086.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0086.198] lstrlenW (lpString=".jpg") returned 4
	[0086.198] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0086.199] lstrcmpiW (lpString1=".JPG", lpString2=".lina") returned -1
	[0086.199] lstrlenW (lpString="MS.JPG") returned 6
	[0086.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0086.897] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1061) returned 1
	[0086.897] CloseHandle (hObject=0x20c) returned 1
	[0086.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20
	[0086.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0086.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0086.898] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.898] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0086.899] GetLastError () returned 0x0
	[0086.899] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x425, lpOverlapped=0x0) returned 1
	[0087.137] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x430, lpOverlapped=0x0) returned 1
	[0087.141] ReadFile (in: hFile=0x20c, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.141] WriteFile (in: hFile=0x210, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0087.141] SetEndOfFile (hFile=0x210) returned 1
	[0087.142] CloseHandle (hObject=0x210) returned 1
	[0087.144] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.144] SetEndOfFile (hFile=0x20c) returned 1
	[0087.146] CloseHandle (hObject=0x20c) returned 1
	[0087.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0087.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1
	[0087.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.148] lstrlenW (lpString=".doc") returned 4
	[0087.148] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0087.148] lstrlenW (lpString=".docx") returned 5
	[0087.148] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0087.148] lstrlenW (lpString=".pdf") returned 4
	[0087.149] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0087.149] lstrlenW (lpString=".xls") returned 4
	[0087.149] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0087.149] lstrlenW (lpString=".xlsx") returned 5
	[0087.149] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0087.149] lstrlenW (lpString=".ppt") returned 4
	[0087.149] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0087.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.150] lstrlenW (lpString=".zip") returned 4
	[0087.150] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0087.150] lstrlenW (lpString=".rar") returned 4
	[0087.150] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0087.150] lstrlenW (lpString=".bz2") returned 4
	[0087.150] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0087.150] lstrlenW (lpString=".7z") returned 3
	[0087.151] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0087.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.152] lstrlenW (lpString=".dbf") returned 4
	[0087.152] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0087.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.152] lstrlenW (lpString=".1cd") returned 4
	[0087.152] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0087.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.153] lstrlenW (lpString=".jpg") returned 4
	[0087.153] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0087.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.154] lstrlenW (lpString=".doc") returned 4
	[0087.154] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0087.154] lstrlenW (lpString=".docx") returned 5
	[0087.154] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0087.155] lstrlenW (lpString=".pdf") returned 4
	[0087.155] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0087.155] lstrlenW (lpString=".xls") returned 4
	[0087.155] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0087.155] lstrlenW (lpString=".xlsx") returned 5
	[0087.155] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0087.155] lstrlenW (lpString=".ppt") returned 4
	[0087.155] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.156] lstrlenW (lpString=".zip") returned 4
	[0087.156] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0087.156] lstrlenW (lpString=".rar") returned 4
	[0087.156] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0087.156] lstrlenW (lpString=".bz2") returned 4
	[0087.156] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0087.156] lstrlenW (lpString=".7z") returned 3
	[0087.157] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0087.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.157] lstrlenW (lpString=".dbf") returned 4
	[0087.157] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0087.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.157] lstrlenW (lpString=".1cd") returned 4
	[0087.157] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0087.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0087.157] lstrlenW (lpString=".jpg") returned 4
	[0087.157] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0087.159] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0087.159] lstrlenW (lpString="Alphabet.xml") returned 12
	[0087.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0089.799] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=791686) returned 1
	[0089.799] CloseHandle (hObject=0x1c8) returned 1
	[0089.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0089.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.800] lstrlenW (lpString=".doc") returned 4
	[0089.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.801] lstrlenW (lpString=".docx") returned 5
	[0089.801] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0089.801] lstrlenW (lpString=".pdf") returned 4
	[0089.801] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.801] lstrlenW (lpString=".xls") returned 4
	[0089.801] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.801] lstrlenW (lpString=".xlsx") returned 5
	[0089.801] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0089.802] lstrlenW (lpString=".ppt") returned 4
	[0089.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.802] lstrlenW (lpString=".zip") returned 4
	[0089.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.802] lstrlenW (lpString=".rar") returned 4
	[0089.802] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.802] lstrlenW (lpString=".bz2") returned 4
	[0089.802] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.803] lstrlenW (lpString=".7z") returned 3
	[0089.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.803] lstrlenW (lpString=".dbf") returned 4
	[0089.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.803] lstrlenW (lpString=".1cd") returned 4
	[0089.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.804] lstrlenW (lpString=".jpg") returned 4
	[0089.804] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.804] lstrlenW (lpString=".doc") returned 4
	[0089.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.804] lstrlenW (lpString=".docx") returned 5
	[0089.805] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0089.805] lstrlenW (lpString=".pdf") returned 4
	[0089.805] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.805] lstrlenW (lpString=".xls") returned 4
	[0089.805] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.805] lstrlenW (lpString=".xlsx") returned 5
	[0089.805] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0089.805] lstrlenW (lpString=".ppt") returned 4
	[0089.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.806] lstrlenW (lpString=".zip") returned 4
	[0089.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.806] lstrlenW (lpString=".rar") returned 4
	[0089.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.806] lstrlenW (lpString=".bz2") returned 4
	[0089.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.807] lstrlenW (lpString=".7z") returned 3
	[0089.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.807] lstrlenW (lpString=".dbf") returned 4
	[0089.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.807] lstrlenW (lpString=".1cd") returned 4
	[0089.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0089.808] lstrlenW (lpString=".jpg") returned 4
	[0089.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.808] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0089.809] lstrlenW (lpString="boxed-join.avi") returned 14
	[0089.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0089.951] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=33280) returned 1
	[0089.951] CloseHandle (hObject=0x208) returned 1
	[0089.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0089.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.952] lstrlenW (lpString=".doc") returned 4
	[0089.952] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.952] lstrlenW (lpString=".docx") returned 5
	[0089.953] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0089.953] lstrlenW (lpString=".pdf") returned 4
	[0089.953] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.953] lstrlenW (lpString=".xls") returned 4
	[0089.953] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.953] lstrlenW (lpString=".xlsx") returned 5
	[0089.953] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0089.953] lstrlenW (lpString=".ppt") returned 4
	[0089.954] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.954] lstrlenW (lpString=".zip") returned 4
	[0089.954] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.954] lstrlenW (lpString=".rar") returned 4
	[0089.954] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.954] lstrlenW (lpString=".bz2") returned 4
	[0089.954] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.955] lstrlenW (lpString=".7z") returned 3
	[0089.955] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.955] lstrlenW (lpString=".dbf") returned 4
	[0089.955] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.956] lstrlenW (lpString=".1cd") returned 4
	[0089.956] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.956] lstrlenW (lpString=".jpg") returned 4
	[0089.956] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0089.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.957] lstrlenW (lpString=".doc") returned 4
	[0089.957] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.957] lstrlenW (lpString=".docx") returned 5
	[0089.957] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0089.957] lstrlenW (lpString=".pdf") returned 4
	[0089.957] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.958] lstrlenW (lpString=".xls") returned 4
	[0089.958] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.958] lstrlenW (lpString=".xlsx") returned 5
	[0089.958] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0089.958] lstrlenW (lpString=".ppt") returned 4
	[0089.958] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.959] lstrlenW (lpString=".zip") returned 4
	[0089.959] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.959] lstrlenW (lpString=".rar") returned 4
	[0089.959] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.959] lstrlenW (lpString=".bz2") returned 4
	[0089.959] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.959] lstrlenW (lpString=".7z") returned 3
	[0089.960] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.960] lstrlenW (lpString=".dbf") returned 4
	[0089.960] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.960] lstrlenW (lpString=".1cd") returned 4
	[0089.960] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0089.961] lstrlenW (lpString=".jpg") returned 4
	[0089.961] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.030] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0090.030] lstrlenW (lpString="delete.avi") returned 10
	[0090.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0090.033] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=224256) returned 1
	[0090.034] CloseHandle (hObject=0x200) returned 1
	[0090.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0090.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.036] lstrlenW (lpString=".doc") returned 4
	[0090.036] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.037] lstrlenW (lpString=".docx") returned 5
	[0090.037] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0090.037] lstrlenW (lpString=".pdf") returned 4
	[0090.037] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.037] lstrlenW (lpString=".xls") returned 4
	[0090.037] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.037] lstrlenW (lpString=".xlsx") returned 5
	[0090.037] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0090.038] lstrlenW (lpString=".ppt") returned 4
	[0090.038] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.038] lstrlenW (lpString=".zip") returned 4
	[0090.038] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.038] lstrlenW (lpString=".rar") returned 4
	[0090.038] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.038] lstrlenW (lpString=".bz2") returned 4
	[0090.039] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.039] lstrlenW (lpString=".7z") returned 3
	[0090.039] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.039] lstrlenW (lpString=".dbf") returned 4
	[0090.039] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.040] lstrlenW (lpString=".1cd") returned 4
	[0090.040] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.040] lstrlenW (lpString=".jpg") returned 4
	[0090.040] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.041] lstrlenW (lpString=".doc") returned 4
	[0090.041] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.041] lstrlenW (lpString=".docx") returned 5
	[0090.041] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0090.041] lstrlenW (lpString=".pdf") returned 4
	[0090.042] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.042] lstrlenW (lpString=".xls") returned 4
	[0090.042] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.042] lstrlenW (lpString=".xlsx") returned 5
	[0090.042] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0090.042] lstrlenW (lpString=".ppt") returned 4
	[0090.042] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.043] lstrlenW (lpString=".zip") returned 4
	[0090.043] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.043] lstrlenW (lpString=".rar") returned 4
	[0090.043] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.043] lstrlenW (lpString=".bz2") returned 4
	[0090.044] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.044] lstrlenW (lpString=".7z") returned 3
	[0090.044] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.044] lstrlenW (lpString=".dbf") returned 4
	[0090.045] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.045] lstrlenW (lpString=".1cd") returned 4
	[0090.045] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0090.045] lstrlenW (lpString=".jpg") returned 4
	[0090.045] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.046] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0090.046] lstrlenW (lpString="split.avi") returned 9
	[0090.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0090.048] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=194048) returned 1
	[0090.048] CloseHandle (hObject=0x200) returned 1
	[0090.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20
	[0090.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.050] lstrlenW (lpString=".doc") returned 4
	[0090.050] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.050] lstrlenW (lpString=".docx") returned 5
	[0090.050] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0090.050] lstrlenW (lpString=".pdf") returned 4
	[0090.050] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.050] lstrlenW (lpString=".xls") returned 4
	[0090.051] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.051] lstrlenW (lpString=".xlsx") returned 5
	[0090.051] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0090.051] lstrlenW (lpString=".ppt") returned 4
	[0090.051] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.051] lstrlenW (lpString=".zip") returned 4
	[0090.051] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.051] lstrlenW (lpString=".rar") returned 4
	[0090.052] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.052] lstrlenW (lpString=".bz2") returned 4
	[0090.052] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.052] lstrlenW (lpString=".7z") returned 3
	[0090.052] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.052] lstrlenW (lpString=".dbf") returned 4
	[0090.052] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.053] lstrlenW (lpString=".1cd") returned 4
	[0090.053] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.053] lstrlenW (lpString=".jpg") returned 4
	[0090.053] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.054] lstrlenW (lpString=".doc") returned 4
	[0090.054] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.054] lstrlenW (lpString=".docx") returned 5
	[0090.054] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0090.054] lstrlenW (lpString=".pdf") returned 4
	[0090.054] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.055] lstrlenW (lpString=".xls") returned 4
	[0090.055] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.055] lstrlenW (lpString=".xlsx") returned 5
	[0090.055] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0090.055] lstrlenW (lpString=".ppt") returned 4
	[0090.055] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.055] lstrlenW (lpString=".zip") returned 4
	[0090.056] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.056] lstrlenW (lpString=".rar") returned 4
	[0090.056] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.056] lstrlenW (lpString=".bz2") returned 4
	[0090.056] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.056] lstrlenW (lpString=".7z") returned 3
	[0090.056] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.057] lstrlenW (lpString=".dbf") returned 4
	[0090.057] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.057] lstrlenW (lpString=".1cd") returned 4
	[0090.057] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66
	[0090.057] lstrlenW (lpString=".jpg") returned 4
	[0090.058] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.059] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0090.059] lstrlenW (lpString="FlickAnimation.avi") returned 18
	[0090.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0090.060] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1600388) returned 1
	[0090.060] CloseHandle (hObject=0x200) returned 1
	[0090.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20
	[0090.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0090.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.062] lstrlenW (lpString=".doc") returned 4
	[0090.062] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.062] lstrlenW (lpString=".docx") returned 5
	[0090.062] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0090.062] lstrlenW (lpString=".pdf") returned 4
	[0090.062] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.063] lstrlenW (lpString=".xls") returned 4
	[0090.063] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.063] lstrlenW (lpString=".xlsx") returned 5
	[0090.063] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0090.063] lstrlenW (lpString=".ppt") returned 4
	[0090.063] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.064] lstrlenW (lpString=".zip") returned 4
	[0090.064] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.064] lstrlenW (lpString=".rar") returned 4
	[0090.064] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.064] lstrlenW (lpString=".bz2") returned 4
	[0090.064] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.064] lstrlenW (lpString=".7z") returned 3
	[0090.065] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.065] lstrlenW (lpString=".dbf") returned 4
	[0090.065] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.065] lstrlenW (lpString=".1cd") returned 4
	[0090.065] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.066] lstrlenW (lpString=".jpg") returned 4
	[0090.066] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.067] lstrlenW (lpString=".doc") returned 4
	[0090.067] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.067] lstrlenW (lpString=".docx") returned 5
	[0090.067] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0090.067] lstrlenW (lpString=".pdf") returned 4
	[0090.067] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.068] lstrlenW (lpString=".xls") returned 4
	[0090.068] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.068] lstrlenW (lpString=".xlsx") returned 5
	[0090.068] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0090.068] lstrlenW (lpString=".ppt") returned 4
	[0090.068] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.069] lstrlenW (lpString=".zip") returned 4
	[0090.069] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.069] lstrlenW (lpString=".rar") returned 4
	[0090.069] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.069] lstrlenW (lpString=".bz2") returned 4
	[0090.069] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.069] lstrlenW (lpString=".7z") returned 3
	[0090.070] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.070] lstrlenW (lpString=".dbf") returned 4
	[0090.070] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.070] lstrlenW (lpString=".1cd") returned 4
	[0090.070] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69
	[0090.071] lstrlenW (lpString=".jpg") returned 4
	[0090.071] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.072] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.072] lstrlenW (lpString="auxbase.xml") returned 11
	[0090.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.657] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1434) returned 1
	[0090.657] CloseHandle (hObject=0x1f4) returned 1
	[0090.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0090.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.658] lstrlenW (lpString=".doc") returned 4
	[0090.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.658] lstrlenW (lpString=".docx") returned 5
	[0090.658] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0090.658] lstrlenW (lpString=".pdf") returned 4
	[0090.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.659] lstrlenW (lpString=".xls") returned 4
	[0090.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.659] lstrlenW (lpString=".xlsx") returned 5
	[0090.659] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0090.659] lstrlenW (lpString=".ppt") returned 4
	[0090.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.659] lstrlenW (lpString=".zip") returned 4
	[0090.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.660] lstrlenW (lpString=".rar") returned 4
	[0090.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.660] lstrlenW (lpString=".bz2") returned 4
	[0090.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.660] lstrlenW (lpString=".7z") returned 3
	[0090.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.660] lstrlenW (lpString=".dbf") returned 4
	[0090.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.661] lstrlenW (lpString=".1cd") returned 4
	[0090.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.661] lstrlenW (lpString=".jpg") returned 4
	[0090.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.661] lstrlenW (lpString=".doc") returned 4
	[0090.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.662] lstrlenW (lpString=".docx") returned 5
	[0090.662] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0090.662] lstrlenW (lpString=".pdf") returned 4
	[0090.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.662] lstrlenW (lpString=".xls") returned 4
	[0090.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.662] lstrlenW (lpString=".xlsx") returned 5
	[0090.662] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0090.663] lstrlenW (lpString=".ppt") returned 4
	[0090.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.663] lstrlenW (lpString=".zip") returned 4
	[0090.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.663] lstrlenW (lpString=".rar") returned 4
	[0090.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.663] lstrlenW (lpString=".bz2") returned 4
	[0090.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.664] lstrlenW (lpString=".7z") returned 3
	[0090.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.664] lstrlenW (lpString=".dbf") returned 4
	[0090.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.664] lstrlenW (lpString=".1cd") returned 4
	[0090.664] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0090.665] lstrlenW (lpString=".jpg") returned 4
	[0090.665] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.666] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.666] lstrlenW (lpString="kor-kor.xml") returned 11
	[0090.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.760] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=392) returned 1
	[0090.760] CloseHandle (hObject=0x1f4) returned 1
	[0090.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20
	[0090.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0090.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0090.762] lstrlenW (lpString=".doc") returned 4
	[0090.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.762] lstrlenW (lpString=".docx") returned 5
	[0090.762] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0090.762] lstrlenW (lpString=".pdf") returned 4
	[0090.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.762] lstrlenW (lpString=".xls") returned 4
	[0090.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.763] lstrlenW (lpString=".xlsx") returned 5
	[0090.763] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0090.763] lstrlenW (lpString=".ppt") returned 4
	[0090.763] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0090.763] lstrlenW (lpString=".zip") returned 4
	[0090.763] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.764] lstrlenW (lpString=".rar") returned 4
	[0090.764] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.764] lstrlenW (lpString=".bz2") returned 4
	[0090.764] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.764] lstrlenW (lpString=".7z") returned 3
	[0090.764] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0090.764] lstrlenW (lpString=".dbf") returned 4
	[0090.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0091.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0091.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0091.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0093.364] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.364] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0093.365] GetLastError () returned 0x0
	[0093.365] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x333, lpOverlapped=0x0) returned 1
	[0094.490] WriteFile (in: hFile=0x1d4, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x340, lpOverlapped=0x0) returned 1
	[0094.492] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.492] WriteFile (in: hFile=0x1d4, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0094.492] SetEndOfFile (hFile=0x1d4) returned 1
	[0094.493] CloseHandle (hObject=0x1d4) returned 1
	[0094.496] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.496] SetEndOfFile (hFile=0x210) returned 1
	[0094.498] CloseHandle (hObject=0x210) returned 1
	[0094.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0094.499] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1
	[0094.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.502] lstrlenW (lpString=".doc") returned 4
	[0094.502] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.502] lstrlenW (lpString=".docx") returned 5
	[0094.502] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0094.503] lstrlenW (lpString=".pdf") returned 4
	[0094.503] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.503] lstrlenW (lpString=".xls") returned 4
	[0094.503] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.503] lstrlenW (lpString=".xlsx") returned 5
	[0094.503] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0094.504] lstrlenW (lpString=".ppt") returned 4
	[0094.504] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.504] lstrlenW (lpString=".zip") returned 4
	[0094.504] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.504] lstrlenW (lpString=".rar") returned 4
	[0094.504] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.505] lstrlenW (lpString=".bz2") returned 4
	[0094.505] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.505] lstrlenW (lpString=".7z") returned 3
	[0094.505] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.506] lstrlenW (lpString=".dbf") returned 4
	[0094.506] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.506] lstrlenW (lpString=".1cd") returned 4
	[0094.506] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.506] lstrlenW (lpString=".jpg") returned 4
	[0094.507] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.507] lstrlenW (lpString=".doc") returned 4
	[0094.507] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.508] lstrlenW (lpString=".docx") returned 5
	[0094.508] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0094.508] lstrlenW (lpString=".pdf") returned 4
	[0094.508] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.508] lstrlenW (lpString=".xls") returned 4
	[0094.508] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.508] lstrlenW (lpString=".xlsx") returned 5
	[0094.509] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0094.509] lstrlenW (lpString=".ppt") returned 4
	[0094.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.509] lstrlenW (lpString=".zip") returned 4
	[0094.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.510] lstrlenW (lpString=".rar") returned 4
	[0094.510] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.510] lstrlenW (lpString=".bz2") returned 4
	[0094.510] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.510] lstrlenW (lpString=".7z") returned 3
	[0094.510] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.511] lstrlenW (lpString=".dbf") returned 4
	[0094.511] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.511] lstrlenW (lpString=".1cd") returned 4
	[0094.511] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0094.512] lstrlenW (lpString=".jpg") returned 4
	[0094.512] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.513] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0094.513] lstrlenW (lpString="ExcelMUI.XML") returned 12
	[0094.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0094.514] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1565) returned 1
	[0094.514] CloseHandle (hObject=0x210) returned 1
	[0094.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20
	[0094.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0094.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0094.515] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.516] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0094.516] GetLastError () returned 0x0
	[0094.517] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x61d, lpOverlapped=0x0) returned 1
	[0094.520] WriteFile (in: hFile=0x1d4, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x620, lpOverlapped=0x0) returned 1
	[0094.522] ReadFile (in: hFile=0x210, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.523] WriteFile (in: hFile=0x1d4, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0094.523] SetEndOfFile (hFile=0x1d4) returned 1
	[0094.524] CloseHandle (hObject=0x1d4) returned 1
	[0094.528] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.528] SetEndOfFile (hFile=0x210) returned 1
	[0094.530] CloseHandle (hObject=0x210) returned 1
	[0094.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0094.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1
	[0094.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.532] lstrlenW (lpString=".doc") returned 4
	[0094.532] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.532] lstrlenW (lpString=".docx") returned 5
	[0094.533] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0094.533] lstrlenW (lpString=".pdf") returned 4
	[0094.533] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.533] lstrlenW (lpString=".xls") returned 4
	[0094.533] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.533] lstrlenW (lpString=".xlsx") returned 5
	[0094.533] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0094.534] lstrlenW (lpString=".ppt") returned 4
	[0094.534] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.534] lstrlenW (lpString=".zip") returned 4
	[0094.534] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.534] lstrlenW (lpString=".rar") returned 4
	[0094.534] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.535] lstrlenW (lpString=".bz2") returned 4
	[0094.535] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.535] lstrlenW (lpString=".7z") returned 3
	[0094.535] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.535] lstrlenW (lpString=".dbf") returned 4
	[0094.536] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.536] lstrlenW (lpString=".1cd") returned 4
	[0094.536] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.767] lstrlenW (lpString=".jpg") returned 4
	[0094.767] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.768] lstrlenW (lpString=".doc") returned 4
	[0094.768] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.768] lstrlenW (lpString=".docx") returned 5
	[0094.768] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0094.768] lstrlenW (lpString=".pdf") returned 4
	[0094.769] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.769] lstrlenW (lpString=".xls") returned 4
	[0094.769] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.769] lstrlenW (lpString=".xlsx") returned 5
	[0094.769] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0094.769] lstrlenW (lpString=".ppt") returned 4
	[0094.770] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.770] lstrlenW (lpString=".zip") returned 4
	[0094.770] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.771] lstrlenW (lpString=".rar") returned 4
	[0094.771] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.771] lstrlenW (lpString=".bz2") returned 4
	[0094.771] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.772] lstrlenW (lpString=".7z") returned 3
	[0094.772] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.772] lstrlenW (lpString=".dbf") returned 4
	[0094.772] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.773] lstrlenW (lpString=".1cd") returned 4
	[0094.773] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0094.773] lstrlenW (lpString=".jpg") returned 4
	[0094.773] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.774] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0094.774] lstrlenW (lpString="GrooveMUI.XML") returned 13
	[0094.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0094.777] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=913) returned 1
	[0094.777] CloseHandle (hObject=0x1d8) returned 1
	[0094.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20
	[0094.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0094.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0094.778] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.779] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0095.826] GetLastError () returned 0x0
	[0095.827] ReadFile (in: hFile=0x1d8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x391, lpOverlapped=0x0) returned 1
	[0095.829] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0095.831] ReadFile (in: hFile=0x1d8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.831] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0095.832] SetEndOfFile (hFile=0x1bc) returned 1
	[0095.832] CloseHandle (hObject=0x1bc) returned 1
	[0095.838] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.838] SetEndOfFile (hFile=0x1d8) returned 1
	[0095.840] CloseHandle (hObject=0x1d8) returned 1
	[0095.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0095.841] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1
	[0095.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.842] lstrlenW (lpString=".doc") returned 4
	[0095.842] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0095.842] lstrlenW (lpString=".docx") returned 5
	[0095.842] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0095.842] lstrlenW (lpString=".pdf") returned 4
	[0095.842] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0095.843] lstrlenW (lpString=".xls") returned 4
	[0095.843] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0095.843] lstrlenW (lpString=".xlsx") returned 5
	[0095.843] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0095.843] lstrlenW (lpString=".ppt") returned 4
	[0095.843] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0095.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.844] lstrlenW (lpString=".zip") returned 4
	[0095.844] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0095.844] lstrlenW (lpString=".rar") returned 4
	[0095.844] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0095.844] lstrlenW (lpString=".bz2") returned 4
	[0095.844] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0095.844] lstrlenW (lpString=".7z") returned 3
	[0095.845] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0095.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.845] lstrlenW (lpString=".dbf") returned 4
	[0095.845] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0095.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.845] lstrlenW (lpString=".1cd") returned 4
	[0095.845] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0095.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.846] lstrlenW (lpString=".jpg") returned 4
	[0095.846] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0095.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.846] lstrlenW (lpString=".doc") returned 4
	[0095.847] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0095.847] lstrlenW (lpString=".docx") returned 5
	[0095.847] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0095.847] lstrlenW (lpString=".pdf") returned 4
	[0095.847] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0095.847] lstrlenW (lpString=".xls") returned 4
	[0095.847] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0095.848] lstrlenW (lpString=".xlsx") returned 5
	[0095.848] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0095.848] lstrlenW (lpString=".ppt") returned 4
	[0095.848] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0095.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.848] lstrlenW (lpString=".zip") returned 4
	[0095.848] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0095.849] lstrlenW (lpString=".rar") returned 4
	[0095.849] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0095.849] lstrlenW (lpString=".bz2") returned 4
	[0095.849] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0095.849] lstrlenW (lpString=".7z") returned 3
	[0095.849] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0095.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.849] lstrlenW (lpString=".dbf") returned 4
	[0095.850] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0095.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.850] lstrlenW (lpString=".1cd") returned 4
	[0095.850] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0095.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0095.850] lstrlenW (lpString=".jpg") returned 4
	[0095.850] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0095.851] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0095.852] lstrlenW (lpString="InfoPathMUI.XML") returned 15
	[0095.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0095.852] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=1231) returned 1
	[0095.852] CloseHandle (hObject=0x1d8) returned 1
	[0095.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20
	[0095.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0095.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0095.853] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.854] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0095.857] GetLastError () returned 0x0
	[0095.857] ReadFile (in: hFile=0x1d8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0096.379] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0096.380] ReadFile (in: hFile=0x1d8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.380] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0096.381] SetEndOfFile (hFile=0x1bc) returned 1
	[0096.381] CloseHandle (hObject=0x1bc) returned 1
	[0096.383] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.383] SetEndOfFile (hFile=0x1d8) returned 1
	[0096.385] CloseHandle (hObject=0x1d8) returned 1
	[0096.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0096.386] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.387] lstrlenW (lpString=".doc") returned 4
	[0096.387] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.387] lstrlenW (lpString=".docx") returned 5
	[0096.387] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0096.388] lstrlenW (lpString=".pdf") returned 4
	[0096.388] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.388] lstrlenW (lpString=".xls") returned 4
	[0096.388] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.388] lstrlenW (lpString=".xlsx") returned 5
	[0096.388] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0096.388] lstrlenW (lpString=".ppt") returned 4
	[0096.388] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.389] lstrlenW (lpString=".zip") returned 4
	[0096.389] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.389] lstrlenW (lpString=".rar") returned 4
	[0096.389] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.389] lstrlenW (lpString=".bz2") returned 4
	[0096.389] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.390] lstrlenW (lpString=".7z") returned 3
	[0096.390] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.390] lstrlenW (lpString=".dbf") returned 4
	[0096.390] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.390] lstrlenW (lpString=".1cd") returned 4
	[0096.391] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.391] lstrlenW (lpString=".jpg") returned 4
	[0096.391] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.391] lstrlenW (lpString=".doc") returned 4
	[0096.392] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.392] lstrlenW (lpString=".docx") returned 5
	[0096.392] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0096.392] lstrlenW (lpString=".pdf") returned 4
	[0096.392] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.392] lstrlenW (lpString=".xls") returned 4
	[0096.392] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.393] lstrlenW (lpString=".xlsx") returned 5
	[0096.393] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0096.393] lstrlenW (lpString=".ppt") returned 4
	[0096.394] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.394] lstrlenW (lpString=".zip") returned 4
	[0096.394] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.394] lstrlenW (lpString=".rar") returned 4
	[0096.394] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.394] lstrlenW (lpString=".bz2") returned 4
	[0096.395] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.395] lstrlenW (lpString=".7z") returned 3
	[0096.395] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.395] lstrlenW (lpString=".dbf") returned 4
	[0096.395] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.396] lstrlenW (lpString=".1cd") returned 4
	[0096.396] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0096.396] lstrlenW (lpString=".jpg") returned 4
	[0096.396] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.397] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0096.398] lstrlenW (lpString="BRANDING.XML") returned 12
	[0096.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0096.768] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=596341) returned 1
	[0096.768] CloseHandle (hObject=0x1f4) returned 1
	[0096.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20
	[0096.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0096.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0096.770] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.770] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0096.771] GetLastError () returned 0x0
	[0096.771] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x91975, lpOverlapped=0x0) returned 1
	[0096.867] WriteFile (in: hFile=0x200, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0097.431] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.431] WriteFile (in: hFile=0x200, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0097.431] SetEndOfFile (hFile=0x200) returned 1
	[0097.985] CloseHandle (hObject=0x200) returned 1
	[0098.900] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.900] SetEndOfFile (hFile=0x1f4) returned 1
	[0098.910] CloseHandle (hObject=0x1f4) returned 1
	[0098.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0098.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1
	[0098.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.913] lstrlenW (lpString=".doc") returned 4
	[0098.913] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.913] lstrlenW (lpString=".docx") returned 5
	[0098.913] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0098.913] lstrlenW (lpString=".pdf") returned 4
	[0098.914] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.914] lstrlenW (lpString=".xls") returned 4
	[0098.914] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.914] lstrlenW (lpString=".xlsx") returned 5
	[0098.914] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0098.914] lstrlenW (lpString=".ppt") returned 4
	[0098.914] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.915] lstrlenW (lpString=".zip") returned 4
	[0098.915] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.915] lstrlenW (lpString=".rar") returned 4
	[0098.918] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.918] lstrlenW (lpString=".bz2") returned 4
	[0098.918] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.918] lstrlenW (lpString=".7z") returned 3
	[0098.919] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.919] lstrlenW (lpString=".dbf") returned 4
	[0098.919] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.924] lstrlenW (lpString=".1cd") returned 4
	[0098.924] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.924] lstrlenW (lpString=".jpg") returned 4
	[0098.924] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.925] lstrlenW (lpString=".doc") returned 4
	[0098.925] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0098.926] lstrlenW (lpString=".docx") returned 5
	[0098.926] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0098.926] lstrlenW (lpString=".pdf") returned 4
	[0098.926] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0098.926] lstrlenW (lpString=".xls") returned 4
	[0098.926] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0098.926] lstrlenW (lpString=".xlsx") returned 5
	[0098.926] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0098.927] lstrlenW (lpString=".ppt") returned 4
	[0098.927] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0098.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.927] lstrlenW (lpString=".zip") returned 4
	[0098.927] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0098.927] lstrlenW (lpString=".rar") returned 4
	[0098.928] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0098.928] lstrlenW (lpString=".bz2") returned 4
	[0098.928] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0098.928] lstrlenW (lpString=".7z") returned 3
	[0098.928] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0098.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.929] lstrlenW (lpString=".dbf") returned 4
	[0098.929] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0098.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.929] lstrlenW (lpString=".1cd") returned 4
	[0098.929] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0098.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0098.930] lstrlenW (lpString=".jpg") returned 4
	[0098.930] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0098.931] lstrcmpiW (lpString1=".CHM", lpString2=".lina") returned -1
	[0098.931] lstrlenW (lpString="SETUP.CHM") returned 9
	[0098.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0099.425] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28cff1c | out: lpFileSize=0x28cff1c*=67190) returned 1
	[0099.425] CloseHandle (hObject=0x1c8) returned 1
	[0099.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20
	[0099.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0099.426] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.427] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.428] GetLastError () returned 0x0
	[0099.428] ReadFile (in: hFile=0x1c8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x10676, lpOverlapped=0x0) returned 1
	[0099.539] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0099.542] ReadFile (in: hFile=0x1c8, lpBuffer=0x2ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28cfed4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesRead=0x28cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.542] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ed0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ed0020*, lpNumberOfBytesWritten=0x28cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0099.542] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.543] CloseHandle (hObject=0x1cc) returned 1
	[0099.543] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.543] SetEndOfFile (hFile=0x1c8) returned 1
	[0099.548] CloseHandle (hObject=0x1c8) returned 1
	[0099.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0099.549] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1
	[0099.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.550] lstrlenW (lpString=".doc") returned 4
	[0099.550] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.550] lstrlenW (lpString=".docx") returned 5
	[0099.550] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0099.550] lstrlenW (lpString=".pdf") returned 4
	[0099.550] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.550] lstrlenW (lpString=".xls") returned 4
	[0099.550] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.551] lstrlenW (lpString=".xlsx") returned 5
	[0099.551] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0099.551] lstrlenW (lpString=".ppt") returned 4
	[0099.551] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.551] lstrlenW (lpString=".zip") returned 4
	[0099.551] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.552] lstrlenW (lpString=".rar") returned 4
	[0099.552] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.552] lstrlenW (lpString=".bz2") returned 4
	[0099.552] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.552] lstrlenW (lpString=".7z") returned 3
	[0099.552] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.552] lstrlenW (lpString=".dbf") returned 4
	[0099.553] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.553] lstrlenW (lpString=".1cd") returned 4
	[0099.553] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.553] lstrlenW (lpString=".jpg") returned 4
	[0099.553] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.554] lstrlenW (lpString=".doc") returned 4
	[0099.554] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.554] lstrlenW (lpString=".docx") returned 5
	[0099.554] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0099.555] lstrlenW (lpString=".pdf") returned 4
	[0099.555] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.555] lstrlenW (lpString=".xls") returned 4
	[0099.555] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.555] lstrlenW (lpString=".xlsx") returned 5
	[0099.555] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0099.555] lstrlenW (lpString=".ppt") returned 4
	[0099.556] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.556] lstrlenW (lpString=".zip") returned 4
	[0099.556] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.556] lstrlenW (lpString=".rar") returned 4
	[0099.556] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.556] lstrlenW (lpString=".bz2") returned 4
	[0099.556] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.557] lstrlenW (lpString=".7z") returned 3
	[0099.557] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.557] lstrlenW (lpString=".dbf") returned 4
	[0099.557] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.557] lstrlenW (lpString=".1cd") returned 4
	[0099.558] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0099.558] lstrlenW (lpString=".jpg") returned 4
	[0099.558] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.560] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0099.560] lstrlenW (lpString="SETUP.XML") returned 9
	[0099.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 10
	os_tid = 0x7c4

	[0072.496] GetTickCount () returned 0x1148b9d
	[0072.497] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x3315c8
	[0072.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3315c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144
	[0072.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3315c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148
	[0072.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3315c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c
	[0072.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x3315c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150
	[0072.572] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b90
	[0072.572] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b90, Size=0x20) returned 0x3398f8
	[0072.572] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b90
	[0072.572] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b90, Size=0x20) returned 0x339920
	[0072.574] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.575] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.575] Wow64DisableWow64FsRedirection (in: OldValue=0x29cff84 | out: OldValue=0x29cff84*=0x0) returned 1
	[0072.575] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.575] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3398f8 | out: hHeap=0x2e0000) returned 1
	[0072.575] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.575] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339920 | out: hHeap=0x2e0000) returned 1
	[0072.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x35fa00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160
	[0072.577] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0073.226] GetTickCount () returned 0x1148d13
	[0073.227] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0073.465] GetTickCount () returned 0x1148dfd
	[0073.465] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0074.825] GetTickCount () returned 0x1148e8a
	[0074.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0074.954] GetTickCount () returned 0x1148f07
	[0074.954] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0075.098] GetTickCount () returned 0x1148f93
	[0075.099] GetTickCount () returned 0x1148fa3
	[0075.099] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0075.320] GetTickCount () returned 0x114907d
	[0075.321] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0075.681] GetTickCount () returned 0x1149148
	[0075.681] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0075.980] GetTickCount () returned 0x1149270
	[0075.980] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0076.473] GetTickCount () returned 0x1149389
	[0076.473] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0076.828] GetTickCount () returned 0x11494e0
	[0076.828] GetTickCount () returned 0x11494e0
	[0076.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0076.977] GetTickCount () returned 0x114957c
	[0076.977] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0077.176] GetTickCount () returned 0x1149647
	[0077.177] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0077.649] GetTickCount () returned 0x1149750
	[0077.649] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0077.949] GetTickCount () returned 0x1149879
	[0077.949] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0078.335] GetTickCount () returned 0x11499ff
	[0078.335] GetTickCount () returned 0x11499ff
	[0078.335] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0078.450] GetTickCount () returned 0x1149a6c
	[0078.451] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0078.905] GetTickCount () returned 0x1149c40
	[0078.905] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0079.377] GetTickCount () returned 0x1149e14
	[0079.377] GetTickCount () returned 0x1149e14
	[0079.377] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0079.910] GetTickCount () returned 0x114a026
	[0079.910] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0080.142] GetTickCount () returned 0x114a110
	[0080.142] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0080.364] GetTickCount () returned 0x114a1eb
	[0080.365] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0080.475] GetTickCount () returned 0x114a258
	[0080.475] GetTickCount () returned 0x114a258
	[0080.475] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0080.692] GetTickCount () returned 0x114a332
	[0080.692] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0080.898] GetTickCount () returned 0x114a3fd
	[0080.898] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0081.321] GetTickCount () returned 0x114a593
	[0081.321] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0082.369] GetTickCount () returned 0x114a6fa
	[0082.369] GetTickCount () returned 0x114a6fa
	[0082.370] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0083.672] GetTickCount () returned 0x114a851
	[0083.672] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0083.870] GetTickCount () returned 0x114a91c
	[0083.870] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.067] GetTickCount () returned 0x114a9d7
	[0084.067] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.233] GetTickCount () returned 0x114aa54
	[0084.233] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.334] GetTickCount () returned 0x114aac1
	[0084.334] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.444] GetTickCount () returned 0x114ab2e
	[0084.444] GetTickCount () returned 0x114ab2e
	[0084.444] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.553] GetTickCount () returned 0x114ab9b
	[0084.553] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.662] GetTickCount () returned 0x114ac08
	[0084.662] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.802] GetTickCount () returned 0x114ac95
	[0084.802] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0084.914] GetTickCount () returned 0x114ad02
	[0084.914] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0085.021] GetTickCount () returned 0x114ad6f
	[0085.021] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0085.130] GetTickCount () returned 0x114addc
	[0085.130] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0085.253] GetTickCount () returned 0x114ae4a
	[0085.253] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0085.348] GetTickCount () returned 0x114aeb7
	[0085.348] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0085.460] GetTickCount () returned 0x114af24
	[0085.460] GetTickCount () returned 0x114af24
	[0085.460] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0085.609] GetTickCount () returned 0x114afb0
	[0085.609] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0086.036] GetTickCount () returned 0x114b156
	[0086.036] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0086.214] GetTickCount () returned 0x114b201
	[0086.214] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0086.483] GetTickCount () returned 0x114b30a
	[0086.483] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0086.769] GetTickCount () returned 0x114b433
	[0086.769] GetTickCount () returned 0x114b433
	[0086.770] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0086.920] GetTickCount () returned 0x114b4bf
	[0086.920] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0087.053] GetTickCount () returned 0x114b54c
	[0087.053] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0089.292] GetTickCount () returned 0x114b5c8
	[0089.293] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0089.390] GetTickCount () returned 0x114b636
	[0089.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0089.538] GetTickCount () returned 0x114b6c2
	[0089.538] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0089.638] GetTickCount () returned 0x114b72f
	[0089.638] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0089.812] GetTickCount () returned 0x114b7db
	[0089.812] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0090.028] GetTickCount () returned 0x114b8b5
	[0090.028] GetTickCount () returned 0x114b8b5
	[0090.028] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0090.217] GetTickCount () returned 0x114b970
	[0090.217] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0090.387] GetTickCount () returned 0x114ba1c
	[0090.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0090.543] GetTickCount () returned 0x114ba89
	[0090.543] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0090.677] GetTickCount () returned 0x114bb06
	[0090.677] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0090.804] GetTickCount () returned 0x114bb83
	[0090.804] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0090.947] GetTickCount () returned 0x114bc0f
	[0090.947] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0091.164] GetTickCount () returned 0x114bcea
	[0091.165] GetTickCount () returned 0x114bcea
	[0091.165] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0091.392] GetTickCount () returned 0x114bdd4
	[0091.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0091.558] GetTickCount () returned 0x114be7f
	[0091.558] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0091.677] GetTickCount () returned 0x114beec
	[0091.677] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0091.822] GetTickCount () returned 0x114bf5a
	[0091.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0092.263] GetTickCount () returned 0x114bfd6
	[0092.263] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0092.492] GetTickCount () returned 0x114c0b1
	[0092.492] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0092.610] GetTickCount () returned 0x114c12e
	[0092.610] GetTickCount () returned 0x114c12e
	[0092.610] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0092.712] GetTickCount () returned 0x114c19b
	[0092.712] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0092.821] GetTickCount () returned 0x114c208
	[0092.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0092.932] GetTickCount () returned 0x114c275
	[0092.933] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0093.040] GetTickCount () returned 0x114c2e2
	[0093.040] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0093.258] GetTickCount () returned 0x114c3bd
	[0093.258] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0093.447] GetTickCount () returned 0x114c478
	[0093.447] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0094.584] GetTickCount () returned 0x114c8eb
	[0094.584] GetTickCount () returned 0x114c8eb
	[0094.584] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0095.164] GetTickCount () returned 0x114cb2c
	[0095.164] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0095.784] GetTickCount () returned 0x114cd9c
	[0095.784] GetTickCount () returned 0x114cd9c
	[0095.784] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0096.141] GetTickCount () returned 0x114cef3
	[0096.141] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0096.719] GetTickCount () returned 0x114d0e6
	[0096.720] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0097.417] GetTickCount () returned 0x114d395
	[0097.417] GetTickCount () returned 0x114d395
	[0097.417] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0097.735] GetTickCount () returned 0x114d4dc
	[0097.736] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0097.992] GetTickCount () returned 0x114d5d6
	[0097.992] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0098.244] GetTickCount () returned 0x114d6d0
	[0098.244] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0098.934] GetTickCount () returned 0x114d920
	[0098.934] GetTickCount () returned 0x114d920
	[0098.934] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0099.207] GetTickCount () returned 0x114da39
	[0099.207] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0099.638] GetTickCount () returned 0x114dbee
	[0099.639] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) 

Thread:
	id = 11
	os_tid = 0x490

	[0072.498] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x38fa30
	[0072.501] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x39fa38
	[0072.502] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b00
	[0072.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a398
	[0072.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b18
	[0072.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3120020
	[0072.506] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b30
	[0072.506] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b30, Size=0x20) returned 0x339858
	[0072.506] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b30
	[0072.506] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b30, Size=0x20) returned 0x3398a8
	[0072.507] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.508] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.508] Wow64DisableWow64FsRedirection (in: OldValue=0x2b0ff58 | out: OldValue=0x2b0ff58*=0x0) returned 1
	[0072.508] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.508] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339858 | out: hHeap=0x2e0000) returned 1
	[0072.508] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.509] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3398a8 | out: hHeap=0x2e0000) returned 1
	[0072.510] Sleep (dwMilliseconds=0x64) 
	[0073.224] Sleep (dwMilliseconds=0x64) 
	[0073.462] Sleep (dwMilliseconds=0x64) 
	[0074.823] Sleep (dwMilliseconds=0x64) 
	[0074.952] Sleep (dwMilliseconds=0x64) 
	[0075.096] Sleep (dwMilliseconds=0x64) 
	[0075.319] Sleep (dwMilliseconds=0x64) 
	[0075.678] Sleep (dwMilliseconds=0x64) 
	[0075.978] Sleep (dwMilliseconds=0x64) 
	[0076.470] Sleep (dwMilliseconds=0x64) 
	[0076.820] Sleep (dwMilliseconds=0x64) 
	[0076.973] lstrcmpiW (lpString1=".BAK", lpString2=".lina") returned -1
	[0076.973] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0076.974] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0077.130] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=8192) returned 1
	[0077.130] CloseHandle (hObject=0x1c4) returned 1
	[0077.130] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0077.130] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\bootsect.bak.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.130] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0077.132] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0077.132] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.132] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.133] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\bootsect.bak.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0077.245] GetLastError () returned 0x0
	[0077.257] ReadFile (in: hFile=0x1c4, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x2000, lpOverlapped=0x0) returned 1
	[0077.272] WriteFile (in: hFile=0x1cc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x2010, lpOverlapped=0x0) returned 1
	[0077.274] ReadFile (in: hFile=0x1c4, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0077.274] WriteFile (in: hFile=0x1cc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0077.275] SetEndOfFile (hFile=0x1cc) returned 1
	[0077.275] CloseHandle (hObject=0x1cc) returned 1
	[0077.281] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.282] SetEndOfFile (hFile=0x1c4) returned 1
	[0077.284] CloseHandle (hObject=0x1c4) returned 1
	[0077.284] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x27) returned 1
	[0077.285] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0077.286] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.286] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.286] lstrlenW (lpString=".doc") returned 4
	[0077.286] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0077.287] lstrlenW (lpString=".docx") returned 5
	[0077.287] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0077.287] lstrlenW (lpString=".pdf") returned 4
	[0077.287] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0077.287] lstrlenW (lpString=".xls") returned 4
	[0077.288] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0077.288] lstrlenW (lpString=".xlsx") returned 5
	[0077.288] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0077.288] lstrlenW (lpString=".ppt") returned 4
	[0077.288] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0077.289] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.289] lstrlenW (lpString=".zip") returned 4
	[0077.289] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0077.289] lstrlenW (lpString=".rar") returned 4
	[0077.289] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0077.289] lstrlenW (lpString=".bz2") returned 4
	[0077.290] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0077.290] lstrlenW (lpString=".7z") returned 3
	[0077.290] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0077.290] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.290] lstrlenW (lpString=".dbf") returned 4
	[0077.291] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0077.291] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.291] lstrlenW (lpString=".1cd") returned 4
	[0077.291] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0077.291] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.292] lstrlenW (lpString=".jpg") returned 4
	[0077.292] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0077.292] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.292] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.292] lstrlenW (lpString=".doc") returned 4
	[0077.293] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0077.293] lstrlenW (lpString=".docx") returned 5
	[0077.293] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0077.293] lstrlenW (lpString=".pdf") returned 4
	[0077.293] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0077.293] lstrlenW (lpString=".xls") returned 4
	[0077.294] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0077.294] lstrlenW (lpString=".xlsx") returned 5
	[0077.294] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0077.294] lstrlenW (lpString=".ppt") returned 4
	[0077.294] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0077.294] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.295] lstrlenW (lpString=".zip") returned 4
	[0077.295] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0077.295] lstrlenW (lpString=".rar") returned 4
	[0077.295] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0077.295] lstrlenW (lpString=".bz2") returned 4
	[0077.295] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0077.296] lstrlenW (lpString=".7z") returned 3
	[0077.296] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0077.296] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.296] lstrlenW (lpString=".dbf") returned 4
	[0077.296] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0077.296] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.296] lstrlenW (lpString=".1cd") returned 4
	[0077.297] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0077.297] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0077.297] lstrlenW (lpString=".jpg") returned 4
	[0077.297] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0077.298] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0077.650] lstrlenW (lpString="PowerPointMUI.xml") returned 17
	[0077.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0077.650] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1450) returned 1
	[0077.650] CloseHandle (hObject=0x1cc) returned 1
	[0077.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020
	[0077.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0077.651] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.652] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0
	[0077.653] GetLastError () returned 0x0
	[0077.653] ReadFile (in: hFile=0x1cc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0077.667] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0077.668] ReadFile (in: hFile=0x1cc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0077.669] WriteFile (in: hFile=0x1d0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0077.669] SetEndOfFile (hFile=0x1d0) returned 1
	[0077.670] CloseHandle (hObject=0x1d0) returned 1
	[0077.672] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.672] SetEndOfFile (hFile=0x1cc) returned 1
	[0077.677] CloseHandle (hObject=0x1cc) returned 1
	[0077.677] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0077.678] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1
	[0077.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.679] lstrlenW (lpString=".doc") returned 4
	[0077.679] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0077.679] lstrlenW (lpString=".docx") returned 5
	[0077.679] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0077.680] lstrlenW (lpString=".pdf") returned 4
	[0077.680] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0077.680] lstrlenW (lpString=".xls") returned 4
	[0077.680] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0077.680] lstrlenW (lpString=".xlsx") returned 5
	[0077.680] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0077.681] lstrlenW (lpString=".ppt") returned 4
	[0077.681] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0077.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.681] lstrlenW (lpString=".zip") returned 4
	[0077.681] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0077.682] lstrlenW (lpString=".rar") returned 4
	[0077.682] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0077.682] lstrlenW (lpString=".bz2") returned 4
	[0077.682] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0077.682] lstrlenW (lpString=".7z") returned 3
	[0077.682] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0077.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.683] lstrlenW (lpString=".dbf") returned 4
	[0077.683] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0077.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.683] lstrlenW (lpString=".1cd") returned 4
	[0077.683] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0077.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.684] lstrlenW (lpString=".jpg") returned 4
	[0077.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0077.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.685] lstrlenW (lpString=".doc") returned 4
	[0077.685] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0077.685] lstrlenW (lpString=".docx") returned 5
	[0077.685] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0077.686] lstrlenW (lpString=".pdf") returned 4
	[0077.686] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0077.686] lstrlenW (lpString=".xls") returned 4
	[0077.686] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0077.686] lstrlenW (lpString=".xlsx") returned 5
	[0077.686] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0077.687] lstrlenW (lpString=".ppt") returned 4
	[0077.687] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0077.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.687] lstrlenW (lpString=".zip") returned 4
	[0077.687] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0077.687] lstrlenW (lpString=".rar") returned 4
	[0077.688] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0077.688] lstrlenW (lpString=".bz2") returned 4
	[0077.688] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0077.688] lstrlenW (lpString=".7z") returned 3
	[0077.688] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0077.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.689] lstrlenW (lpString=".dbf") returned 4
	[0077.689] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0077.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.690] lstrlenW (lpString=".1cd") returned 4
	[0077.690] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0077.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0077.690] lstrlenW (lpString=".jpg") returned 4
	[0077.690] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0077.691] Sleep (dwMilliseconds=0x64) 
	[0077.992] Sleep (dwMilliseconds=0x64) 
	[0078.344] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.345] lstrlenW (lpString="Setup.xml") returned 9
	[0078.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.345] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2424) returned 1
	[0078.346] CloseHandle (hObject=0x1ec) returned 1
	[0078.346] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0078.346] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.347] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.347] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.347] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0078.447] GetLastError () returned 0x0
	[0078.447] ReadFile (in: hFile=0x1ec, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x978, lpOverlapped=0x0) returned 1
	[0078.701] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0078.702] ReadFile (in: hFile=0x1ec, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.702] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.703] SetEndOfFile (hFile=0x1f0) returned 1
	[0078.703] CloseHandle (hObject=0x1f0) returned 1
	[0078.708] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.708] SetEndOfFile (hFile=0x1ec) returned 1
	[0078.710] CloseHandle (hObject=0x1ec) returned 1
	[0078.710] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.711] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0078.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.712] lstrlenW (lpString=".doc") returned 4
	[0078.712] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.712] lstrlenW (lpString=".docx") returned 5
	[0078.712] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.712] lstrlenW (lpString=".pdf") returned 4
	[0078.713] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.713] lstrlenW (lpString=".xls") returned 4
	[0078.713] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.713] lstrlenW (lpString=".xlsx") returned 5
	[0078.713] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.713] lstrlenW (lpString=".ppt") returned 4
	[0078.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.714] lstrlenW (lpString=".zip") returned 4
	[0078.714] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.714] lstrlenW (lpString=".rar") returned 4
	[0078.714] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.714] lstrlenW (lpString=".bz2") returned 4
	[0078.714] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.715] lstrlenW (lpString=".7z") returned 3
	[0078.715] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.715] lstrlenW (lpString=".dbf") returned 4
	[0078.715] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.716] lstrlenW (lpString=".1cd") returned 4
	[0078.716] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.716] lstrlenW (lpString=".jpg") returned 4
	[0078.716] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.717] lstrlenW (lpString=".doc") returned 4
	[0078.717] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.717] lstrlenW (lpString=".docx") returned 5
	[0078.717] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.718] lstrlenW (lpString=".pdf") returned 4
	[0078.719] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.719] lstrlenW (lpString=".xls") returned 4
	[0078.719] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.719] lstrlenW (lpString=".xlsx") returned 5
	[0078.719] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.720] lstrlenW (lpString=".ppt") returned 4
	[0078.720] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.720] lstrlenW (lpString=".zip") returned 4
	[0078.720] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.720] lstrlenW (lpString=".rar") returned 4
	[0078.720] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.721] lstrlenW (lpString=".bz2") returned 4
	[0078.721] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.721] lstrlenW (lpString=".7z") returned 3
	[0078.721] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.721] lstrlenW (lpString=".dbf") returned 4
	[0078.722] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.722] lstrlenW (lpString=".1cd") returned 4
	[0078.722] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.722] lstrlenW (lpString=".jpg") returned 4
	[0078.722] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.724] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.724] lstrlenW (lpString="Proofing.xml") returned 12
	[0078.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.725] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=811) returned 1
	[0078.725] CloseHandle (hObject=0x1ec) returned 1
	[0078.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020
	[0078.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0078.726] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.726] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0078.727] GetLastError () returned 0x0
	[0078.727] ReadFile (in: hFile=0x1ec, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x32b, lpOverlapped=0x0) returned 1
	[0079.142] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0079.143] ReadFile (in: hFile=0x1ec, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.143] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0079.144] SetEndOfFile (hFile=0x1f0) returned 1
	[0079.144] CloseHandle (hObject=0x1f0) returned 1
	[0079.145] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.146] SetEndOfFile (hFile=0x1ec) returned 1
	[0079.147] CloseHandle (hObject=0x1ec) returned 1
	[0079.148] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.148] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1
	[0079.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.149] lstrlenW (lpString=".doc") returned 4
	[0079.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.149] lstrlenW (lpString=".docx") returned 5
	[0079.150] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0079.150] lstrlenW (lpString=".pdf") returned 4
	[0079.150] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.150] lstrlenW (lpString=".xls") returned 4
	[0079.150] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.150] lstrlenW (lpString=".xlsx") returned 5
	[0079.150] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0079.150] lstrlenW (lpString=".ppt") returned 4
	[0079.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.151] lstrlenW (lpString=".zip") returned 4
	[0079.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.151] lstrlenW (lpString=".rar") returned 4
	[0079.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.151] lstrlenW (lpString=".bz2") returned 4
	[0079.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.152] lstrlenW (lpString=".7z") returned 3
	[0079.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.152] lstrlenW (lpString=".dbf") returned 4
	[0079.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.152] lstrlenW (lpString=".1cd") returned 4
	[0079.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.153] lstrlenW (lpString=".jpg") returned 4
	[0079.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.154] lstrlenW (lpString=".doc") returned 4
	[0079.154] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.154] lstrlenW (lpString=".docx") returned 5
	[0079.154] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0079.154] lstrlenW (lpString=".pdf") returned 4
	[0079.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.155] lstrlenW (lpString=".xls") returned 4
	[0079.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.155] lstrlenW (lpString=".xlsx") returned 5
	[0079.155] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0079.156] lstrlenW (lpString=".ppt") returned 4
	[0079.156] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.156] lstrlenW (lpString=".zip") returned 4
	[0079.156] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.156] lstrlenW (lpString=".rar") returned 4
	[0079.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.157] lstrlenW (lpString=".bz2") returned 4
	[0079.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.157] lstrlenW (lpString=".7z") returned 3
	[0079.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.158] lstrlenW (lpString=".dbf") returned 4
	[0079.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.158] lstrlenW (lpString=".1cd") returned 4
	[0079.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0079.158] lstrlenW (lpString=".jpg") returned 4
	[0079.159] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.160] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0079.160] lstrlenW (lpString="InfoPathMUI.xml") returned 15
	[0079.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0079.162] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1231) returned 1
	[0079.162] CloseHandle (hObject=0x1ec) returned 1
	[0079.162] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020
	[0079.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0079.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0079.163] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.163] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0079.164] GetLastError () returned 0x0
	[0079.164] ReadFile (in: hFile=0x1ec, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0079.432] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0079.433] ReadFile (in: hFile=0x1ec, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.434] WriteFile (in: hFile=0x1f0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0079.434] SetEndOfFile (hFile=0x1f0) returned 1
	[0079.435] CloseHandle (hObject=0x1f0) returned 1
	[0079.437] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.438] SetEndOfFile (hFile=0x1ec) returned 1
	[0079.440] CloseHandle (hObject=0x1ec) returned 1
	[0079.440] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.441] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1
	[0079.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.442] lstrlenW (lpString=".doc") returned 4
	[0079.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.443] lstrlenW (lpString=".docx") returned 5
	[0079.443] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0079.443] lstrlenW (lpString=".pdf") returned 4
	[0079.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.443] lstrlenW (lpString=".xls") returned 4
	[0079.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.444] lstrlenW (lpString=".xlsx") returned 5
	[0079.444] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0079.444] lstrlenW (lpString=".ppt") returned 4
	[0079.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.445] lstrlenW (lpString=".zip") returned 4
	[0079.445] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.445] lstrlenW (lpString=".rar") returned 4
	[0079.445] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.445] lstrlenW (lpString=".bz2") returned 4
	[0079.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.446] lstrlenW (lpString=".7z") returned 3
	[0079.446] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.446] lstrlenW (lpString=".dbf") returned 4
	[0079.447] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.447] lstrlenW (lpString=".1cd") returned 4
	[0079.447] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.447] lstrlenW (lpString=".jpg") returned 4
	[0079.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.449] lstrlenW (lpString=".doc") returned 4
	[0079.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.449] lstrlenW (lpString=".docx") returned 5
	[0079.449] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0079.449] lstrlenW (lpString=".pdf") returned 4
	[0079.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.450] lstrlenW (lpString=".xls") returned 4
	[0079.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.450] lstrlenW (lpString=".xlsx") returned 5
	[0079.450] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0079.450] lstrlenW (lpString=".ppt") returned 4
	[0079.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.451] lstrlenW (lpString=".zip") returned 4
	[0079.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.904] lstrlenW (lpString=".rar") returned 4
	[0079.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.905] lstrlenW (lpString=".bz2") returned 4
	[0079.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.905] lstrlenW (lpString=".7z") returned 3
	[0079.905] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.906] lstrlenW (lpString=".dbf") returned 4
	[0079.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.906] lstrlenW (lpString=".1cd") returned 4
	[0079.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0079.907] lstrlenW (lpString=".jpg") returned 4
	[0079.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.908] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0079.908] lstrlenW (lpString="ProjectMUI.xml") returned 14
	[0079.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0080.203] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1452) returned 1
	[0080.203] CloseHandle (hObject=0x1f0) returned 1
	[0080.204] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020
	[0080.204] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0080.204] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.205] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0080.206] GetLastError () returned 0x0
	[0080.206] ReadFile (in: hFile=0x1f0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0080.230] WriteFile (in: hFile=0x200, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0080.232] ReadFile (in: hFile=0x1f0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.232] WriteFile (in: hFile=0x200, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0080.232] SetEndOfFile (hFile=0x200) returned 1
	[0080.233] CloseHandle (hObject=0x200) returned 1
	[0080.236] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.236] SetEndOfFile (hFile=0x1f0) returned 1
	[0080.251] CloseHandle (hObject=0x1f0) returned 1
	[0080.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.253] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1
	[0080.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.254] lstrlenW (lpString=".doc") returned 4
	[0080.254] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.254] lstrlenW (lpString=".docx") returned 5
	[0080.254] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.254] lstrlenW (lpString=".pdf") returned 4
	[0080.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.255] lstrlenW (lpString=".xls") returned 4
	[0080.255] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.255] lstrlenW (lpString=".xlsx") returned 5
	[0080.255] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.255] lstrlenW (lpString=".ppt") returned 4
	[0080.256] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.256] lstrlenW (lpString=".zip") returned 4
	[0080.256] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.256] lstrlenW (lpString=".rar") returned 4
	[0080.256] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.257] lstrlenW (lpString=".bz2") returned 4
	[0080.257] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.257] lstrlenW (lpString=".7z") returned 3
	[0080.257] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.257] lstrlenW (lpString=".dbf") returned 4
	[0080.258] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.258] lstrlenW (lpString=".1cd") returned 4
	[0080.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.258] lstrlenW (lpString=".jpg") returned 4
	[0080.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.259] lstrlenW (lpString=".doc") returned 4
	[0080.259] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.260] lstrlenW (lpString=".docx") returned 5
	[0080.260] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.260] lstrlenW (lpString=".pdf") returned 4
	[0080.260] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.260] lstrlenW (lpString=".xls") returned 4
	[0080.260] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.260] lstrlenW (lpString=".xlsx") returned 5
	[0080.261] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.261] lstrlenW (lpString=".ppt") returned 4
	[0080.261] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.261] lstrlenW (lpString=".zip") returned 4
	[0080.261] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.262] lstrlenW (lpString=".rar") returned 4
	[0080.262] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.262] lstrlenW (lpString=".bz2") returned 4
	[0080.262] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.262] lstrlenW (lpString=".7z") returned 3
	[0080.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.366] lstrlenW (lpString=".dbf") returned 4
	[0080.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.366] lstrlenW (lpString=".1cd") returned 4
	[0080.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0080.367] lstrlenW (lpString=".jpg") returned 4
	[0080.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.368] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0080.368] lstrlenW (lpString="Setup.xml") returned 9
	[0080.369] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0080.545] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1452) returned 1
	[0080.545] CloseHandle (hObject=0x1d4) returned 1
	[0080.545] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0080.545] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0080.546] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.546] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0080.547] GetLastError () returned 0x0
	[0080.547] ReadFile (in: hFile=0x1d4, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0080.777] WriteFile (in: hFile=0x208, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0080.779] ReadFile (in: hFile=0x1d4, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.779] WriteFile (in: hFile=0x208, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0080.780] SetEndOfFile (hFile=0x208) returned 1
	[0080.780] CloseHandle (hObject=0x208) returned 1
	[0080.784] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.784] SetEndOfFile (hFile=0x1d4) returned 1
	[0080.786] CloseHandle (hObject=0x1d4) returned 1
	[0080.786] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.787] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0080.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.788] lstrlenW (lpString=".doc") returned 4
	[0080.788] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.788] lstrlenW (lpString=".docx") returned 5
	[0080.788] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0080.788] lstrlenW (lpString=".pdf") returned 4
	[0080.789] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.789] lstrlenW (lpString=".xls") returned 4
	[0080.789] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.789] lstrlenW (lpString=".xlsx") returned 5
	[0080.789] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0080.789] lstrlenW (lpString=".ppt") returned 4
	[0080.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.790] lstrlenW (lpString=".zip") returned 4
	[0080.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.790] lstrlenW (lpString=".rar") returned 4
	[0080.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.790] lstrlenW (lpString=".bz2") returned 4
	[0080.791] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.791] lstrlenW (lpString=".7z") returned 3
	[0080.791] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.791] lstrlenW (lpString=".dbf") returned 4
	[0080.791] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.792] lstrlenW (lpString=".1cd") returned 4
	[0080.792] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.792] lstrlenW (lpString=".jpg") returned 4
	[0080.792] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.793] lstrlenW (lpString=".doc") returned 4
	[0080.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.794] lstrlenW (lpString=".docx") returned 5
	[0080.794] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0080.794] lstrlenW (lpString=".pdf") returned 4
	[0080.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.794] lstrlenW (lpString=".xls") returned 4
	[0080.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.794] lstrlenW (lpString=".xlsx") returned 5
	[0080.795] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0080.795] lstrlenW (lpString=".ppt") returned 4
	[0080.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.795] lstrlenW (lpString=".zip") returned 4
	[0080.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.795] lstrlenW (lpString=".rar") returned 4
	[0080.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.796] lstrlenW (lpString=".bz2") returned 4
	[0080.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.796] lstrlenW (lpString=".7z") returned 3
	[0080.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.797] lstrlenW (lpString=".dbf") returned 4
	[0080.797] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.797] lstrlenW (lpString=".1cd") returned 4
	[0080.797] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.797] lstrlenW (lpString=".jpg") returned 4
	[0080.798] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.799] lstrcmpiW (lpString1=".chm", lpString2=".lina") returned -1
	[0080.799] lstrlenW (lpString="setup.chm") returned 9
	[0080.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0081.091] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=67190) returned 1
	[0081.091] CloseHandle (hObject=0x1c8) returned 1
	[0081.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020
	[0081.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0081.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0081.092] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.092] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0081.093] GetLastError () returned 0x0
	[0081.093] ReadFile (in: hFile=0x1c8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x10676, lpOverlapped=0x0) returned 1
	[0083.477] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0083.479] ReadFile (in: hFile=0x1c8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.479] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0083.480] SetEndOfFile (hFile=0x1fc) returned 1
	[0083.480] CloseHandle (hObject=0x1fc) returned 1
	[0083.488] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.489] SetEndOfFile (hFile=0x1c8) returned 1
	[0083.490] CloseHandle (hObject=0x1c8) returned 1
	[0083.491] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0083.491] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1
	[0083.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.492] lstrlenW (lpString=".doc") returned 4
	[0083.492] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0083.492] lstrlenW (lpString=".docx") returned 5
	[0083.492] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0083.492] lstrlenW (lpString=".pdf") returned 4
	[0083.492] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0083.493] lstrlenW (lpString=".xls") returned 4
	[0083.493] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0083.493] lstrlenW (lpString=".xlsx") returned 5
	[0083.493] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0083.493] lstrlenW (lpString=".ppt") returned 4
	[0083.493] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0083.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.493] lstrlenW (lpString=".zip") returned 4
	[0083.493] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0083.493] lstrlenW (lpString=".rar") returned 4
	[0083.494] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0083.494] lstrlenW (lpString=".bz2") returned 4
	[0083.494] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0083.494] lstrlenW (lpString=".7z") returned 3
	[0083.494] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0083.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.494] lstrlenW (lpString=".dbf") returned 4
	[0083.494] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0083.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.494] lstrlenW (lpString=".1cd") returned 4
	[0083.494] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0083.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.495] lstrlenW (lpString=".jpg") returned 4
	[0083.495] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0083.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.495] lstrlenW (lpString=".doc") returned 4
	[0083.495] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0083.495] lstrlenW (lpString=".docx") returned 5
	[0083.495] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0083.496] lstrlenW (lpString=".pdf") returned 4
	[0083.496] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0083.496] lstrlenW (lpString=".xls") returned 4
	[0083.496] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0083.496] lstrlenW (lpString=".xlsx") returned 5
	[0083.496] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0083.496] lstrlenW (lpString=".ppt") returned 4
	[0083.496] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0083.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.496] lstrlenW (lpString=".zip") returned 4
	[0083.496] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0083.496] lstrlenW (lpString=".rar") returned 4
	[0083.497] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0083.497] lstrlenW (lpString=".bz2") returned 4
	[0083.497] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0083.497] lstrlenW (lpString=".7z") returned 3
	[0083.497] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0083.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.497] lstrlenW (lpString=".dbf") returned 4
	[0083.497] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0083.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.497] lstrlenW (lpString=".1cd") returned 4
	[0083.497] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0083.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0083.498] lstrlenW (lpString=".jpg") returned 4
	[0083.498] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0083.498] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0083.498] lstrlenW (lpString="branding.xml") returned 12
	[0083.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0083.499] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=596341) returned 1
	[0083.499] CloseHandle (hObject=0x1c8) returned 1
	[0083.499] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020
	[0083.499] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0083.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0083.500] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.500] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0083.500] GetLastError () returned 0x0
	[0083.500] ReadFile (in: hFile=0x1c8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0085.511] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0086.067] ReadFile (in: hFile=0x1c8, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.067] WriteFile (in: hFile=0x1fc, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0086.067] SetEndOfFile (hFile=0x1fc) returned 1
	[0086.068] CloseHandle (hObject=0x1fc) returned 1
	[0086.076] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.077] SetEndOfFile (hFile=0x1c8) returned 1
	[0086.322] CloseHandle (hObject=0x1c8) returned 1
	[0086.323] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0086.324] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1
	[0086.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.325] lstrlenW (lpString=".doc") returned 4
	[0086.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0086.325] lstrlenW (lpString=".docx") returned 5
	[0086.325] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0086.325] lstrlenW (lpString=".pdf") returned 4
	[0086.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0086.325] lstrlenW (lpString=".xls") returned 4
	[0086.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0086.325] lstrlenW (lpString=".xlsx") returned 5
	[0086.325] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0086.326] lstrlenW (lpString=".ppt") returned 4
	[0086.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0086.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.326] lstrlenW (lpString=".zip") returned 4
	[0086.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0086.326] lstrlenW (lpString=".rar") returned 4
	[0086.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0086.326] lstrlenW (lpString=".bz2") returned 4
	[0086.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0086.327] lstrlenW (lpString=".7z") returned 3
	[0086.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0086.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.327] lstrlenW (lpString=".dbf") returned 4
	[0086.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0086.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.327] lstrlenW (lpString=".1cd") returned 4
	[0086.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0086.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.328] lstrlenW (lpString=".jpg") returned 4
	[0086.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0086.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.328] lstrlenW (lpString=".doc") returned 4
	[0086.329] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0086.329] lstrlenW (lpString=".docx") returned 5
	[0086.329] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0086.329] lstrlenW (lpString=".pdf") returned 4
	[0086.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0086.329] lstrlenW (lpString=".xls") returned 4
	[0086.329] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0086.329] lstrlenW (lpString=".xlsx") returned 5
	[0086.329] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0086.330] lstrlenW (lpString=".ppt") returned 4
	[0086.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0086.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.330] lstrlenW (lpString=".zip") returned 4
	[0086.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0086.330] lstrlenW (lpString=".rar") returned 4
	[0086.330] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0086.330] lstrlenW (lpString=".bz2") returned 4
	[0086.330] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0086.331] lstrlenW (lpString=".7z") returned 3
	[0086.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0086.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.331] lstrlenW (lpString=".dbf") returned 4
	[0086.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0086.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.332] lstrlenW (lpString=".1cd") returned 4
	[0086.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0086.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0086.332] lstrlenW (lpString=".jpg") returned 4
	[0086.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0086.333] lstrcmpiW (lpString1=".PNG", lpString2=".lina") returned 1
	[0086.333] lstrlenW (lpString="MS.PNG") returned 6
	[0086.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0086.956] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1682) returned 1
	[0086.956] CloseHandle (hObject=0x1f4) returned 1
	[0086.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20
	[0086.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0086.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0086.957] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.957] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0086.958] GetLastError () returned 0x0
	[0086.958] ReadFile (in: hFile=0x1f4, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x692, lpOverlapped=0x0) returned 1
	[0090.638] WriteFile (in: hFile=0x1e0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x6a0, lpOverlapped=0x0) returned 1
	[0090.639] ReadFile (in: hFile=0x1f4, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0090.640] WriteFile (in: hFile=0x1e0, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0090.640] SetEndOfFile (hFile=0x1e0) returned 1
	[0090.640] CloseHandle (hObject=0x1e0) returned 1
	[0090.641] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0090.642] SetEndOfFile (hFile=0x1f4) returned 1
	[0090.643] CloseHandle (hObject=0x1f4) returned 1
	[0090.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0090.644] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1
	[0090.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.645] lstrlenW (lpString=".doc") returned 4
	[0090.645] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.645] lstrlenW (lpString=".docx") returned 5
	[0090.645] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0090.645] lstrlenW (lpString=".pdf") returned 4
	[0090.645] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.645] lstrlenW (lpString=".xls") returned 4
	[0090.645] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.645] lstrlenW (lpString=".xlsx") returned 5
	[0090.646] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0090.646] lstrlenW (lpString=".ppt") returned 4
	[0090.646] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.646] lstrlenW (lpString=".zip") returned 4
	[0090.646] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.646] lstrlenW (lpString=".rar") returned 4
	[0090.646] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.646] lstrlenW (lpString=".bz2") returned 4
	[0090.647] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.647] lstrlenW (lpString=".7z") returned 3
	[0090.647] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.647] lstrlenW (lpString=".dbf") returned 4
	[0090.647] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.647] lstrlenW (lpString=".1cd") returned 4
	[0090.648] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.648] lstrlenW (lpString=".jpg") returned 4
	[0090.648] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.648] lstrlenW (lpString=".doc") returned 4
	[0090.649] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0090.649] lstrlenW (lpString=".docx") returned 5
	[0090.649] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0090.649] lstrlenW (lpString=".pdf") returned 4
	[0090.649] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0090.649] lstrlenW (lpString=".xls") returned 4
	[0090.649] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0090.649] lstrlenW (lpString=".xlsx") returned 5
	[0090.650] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0090.650] lstrlenW (lpString=".ppt") returned 4
	[0090.650] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0090.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.650] lstrlenW (lpString=".zip") returned 4
	[0090.650] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0090.651] lstrlenW (lpString=".rar") returned 4
	[0090.652] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0090.653] lstrlenW (lpString=".bz2") returned 4
	[0090.653] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0090.653] lstrlenW (lpString=".7z") returned 3
	[0090.653] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0090.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.653] lstrlenW (lpString=".dbf") returned 4
	[0090.653] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0090.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.654] lstrlenW (lpString=".1cd") returned 4
	[0090.654] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0090.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0090.654] lstrlenW (lpString=".jpg") returned 4
	[0090.654] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0090.655] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.655] lstrlenW (lpString="keypadbase.xml") returned 14
	[0090.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.747] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1118) returned 1
	[0090.747] CloseHandle (hObject=0x1f4) returned 1
	[0090.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20
	[0090.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.748] lstrlenW (lpString=".doc") returned 4
	[0090.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.748] lstrlenW (lpString=".docx") returned 5
	[0090.748] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0090.749] lstrlenW (lpString=".pdf") returned 4
	[0090.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.749] lstrlenW (lpString=".xls") returned 4
	[0090.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.749] lstrlenW (lpString=".xlsx") returned 5
	[0090.749] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0090.749] lstrlenW (lpString=".ppt") returned 4
	[0090.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.750] lstrlenW (lpString=".zip") returned 4
	[0090.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.750] lstrlenW (lpString=".rar") returned 4
	[0090.750] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.750] lstrlenW (lpString=".bz2") returned 4
	[0090.750] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.750] lstrlenW (lpString=".7z") returned 3
	[0090.750] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.750] lstrlenW (lpString=".dbf") returned 4
	[0090.751] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.751] lstrlenW (lpString=".1cd") returned 4
	[0090.751] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.751] lstrlenW (lpString=".jpg") returned 4
	[0090.751] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.752] lstrlenW (lpString=".doc") returned 4
	[0090.752] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.752] lstrlenW (lpString=".docx") returned 5
	[0090.752] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0090.752] lstrlenW (lpString=".pdf") returned 4
	[0090.752] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.752] lstrlenW (lpString=".xls") returned 4
	[0090.753] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.753] lstrlenW (lpString=".xlsx") returned 5
	[0090.753] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0090.753] lstrlenW (lpString=".ppt") returned 4
	[0090.753] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.753] lstrlenW (lpString=".zip") returned 4
	[0090.753] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.754] lstrlenW (lpString=".rar") returned 4
	[0090.754] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.754] lstrlenW (lpString=".bz2") returned 4
	[0090.754] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.754] lstrlenW (lpString=".7z") returned 3
	[0090.754] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.754] lstrlenW (lpString=".dbf") returned 4
	[0090.754] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.755] lstrlenW (lpString=".1cd") returned 4
	[0090.755] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0090.755] lstrlenW (lpString=".jpg") returned 4
	[0090.755] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.756] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.756] lstrlenW (lpString="base.xml") returned 8
	[0090.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0091.380] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=3150) returned 1
	[0091.380] CloseHandle (hObject=0x1f0) returned 1
	[0091.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20
	[0091.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0091.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.382] lstrlenW (lpString=".doc") returned 4
	[0091.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.383] lstrlenW (lpString=".docx") returned 5
	[0091.383] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0091.383] lstrlenW (lpString=".pdf") returned 4
	[0091.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.383] lstrlenW (lpString=".xls") returned 4
	[0091.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.383] lstrlenW (lpString=".xlsx") returned 5
	[0091.384] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0091.384] lstrlenW (lpString=".ppt") returned 4
	[0091.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.384] lstrlenW (lpString=".zip") returned 4
	[0091.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.384] lstrlenW (lpString=".rar") returned 4
	[0091.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.385] lstrlenW (lpString=".bz2") returned 4
	[0091.385] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.385] lstrlenW (lpString=".7z") returned 3
	[0091.385] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.385] lstrlenW (lpString=".dbf") returned 4
	[0091.385] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.386] lstrlenW (lpString=".1cd") returned 4
	[0091.386] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.386] lstrlenW (lpString=".jpg") returned 4
	[0091.386] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.387] lstrlenW (lpString=".doc") returned 4
	[0091.387] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.387] lstrlenW (lpString=".docx") returned 5
	[0091.387] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0091.387] lstrlenW (lpString=".pdf") returned 4
	[0091.387] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.387] lstrlenW (lpString=".xls") returned 4
	[0091.388] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.388] lstrlenW (lpString=".xlsx") returned 5
	[0091.388] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0091.388] lstrlenW (lpString=".ppt") returned 4
	[0091.388] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.388] lstrlenW (lpString=".zip") returned 4
	[0091.388] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.388] lstrlenW (lpString=".rar") returned 4
	[0091.389] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.389] lstrlenW (lpString=".bz2") returned 4
	[0091.389] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.389] lstrlenW (lpString=".7z") returned 3
	[0091.389] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.389] lstrlenW (lpString=".dbf") returned 4
	[0091.389] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.389] lstrlenW (lpString=".1cd") returned 4
	[0091.390] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0091.390] lstrlenW (lpString=".jpg") returned 4
	[0091.390] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.391] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0091.391] lstrlenW (lpString="ipsjpn.xml") returned 10
	[0091.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0091.606] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2522) returned 1
	[0091.606] CloseHandle (hObject=0x1f4) returned 1
	[0091.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20
	[0091.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0091.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.607] lstrlenW (lpString=".doc") returned 4
	[0091.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.607] lstrlenW (lpString=".docx") returned 5
	[0091.607] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0091.607] lstrlenW (lpString=".pdf") returned 4
	[0091.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.608] lstrlenW (lpString=".xls") returned 4
	[0091.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.608] lstrlenW (lpString=".xlsx") returned 5
	[0091.608] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0091.608] lstrlenW (lpString=".ppt") returned 4
	[0091.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.609] lstrlenW (lpString=".zip") returned 4
	[0091.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.609] lstrlenW (lpString=".rar") returned 4
	[0091.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.609] lstrlenW (lpString=".bz2") returned 4
	[0091.619] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.619] lstrlenW (lpString=".7z") returned 3
	[0091.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.620] lstrlenW (lpString=".dbf") returned 4
	[0091.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.620] lstrlenW (lpString=".1cd") returned 4
	[0091.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.620] lstrlenW (lpString=".jpg") returned 4
	[0091.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.621] lstrlenW (lpString=".doc") returned 4
	[0091.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.621] lstrlenW (lpString=".docx") returned 5
	[0091.621] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0091.621] lstrlenW (lpString=".pdf") returned 4
	[0091.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.621] lstrlenW (lpString=".xls") returned 4
	[0091.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.622] lstrlenW (lpString=".xlsx") returned 5
	[0091.622] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0091.622] lstrlenW (lpString=".ppt") returned 4
	[0091.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.622] lstrlenW (lpString=".zip") returned 4
	[0091.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.622] lstrlenW (lpString=".rar") returned 4
	[0091.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.622] lstrlenW (lpString=".bz2") returned 4
	[0091.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.623] lstrlenW (lpString=".7z") returned 3
	[0091.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.623] lstrlenW (lpString=".dbf") returned 4
	[0091.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.623] lstrlenW (lpString=".1cd") returned 4
	[0091.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0091.629] lstrlenW (lpString=".jpg") returned 4
	[0091.629] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.629] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0091.630] lstrlenW (lpString="ipskor.xml") returned 10
	[0091.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0093.323] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2568) returned 1
	[0093.323] CloseHandle (hObject=0x1f0) returned 1
	[0093.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20
	[0093.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0093.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0093.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.325] lstrlenW (lpString=".doc") returned 4
	[0093.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.325] lstrlenW (lpString=".docx") returned 5
	[0093.325] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0093.325] lstrlenW (lpString=".pdf") returned 4
	[0093.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.325] lstrlenW (lpString=".xls") returned 4
	[0093.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.326] lstrlenW (lpString=".xlsx") returned 5
	[0093.326] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0093.326] lstrlenW (lpString=".ppt") returned 4
	[0093.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.326] lstrlenW (lpString=".zip") returned 4
	[0093.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.327] lstrlenW (lpString=".rar") returned 4
	[0093.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.327] lstrlenW (lpString=".bz2") returned 4
	[0093.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.327] lstrlenW (lpString=".7z") returned 3
	[0093.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.327] lstrlenW (lpString=".dbf") returned 4
	[0093.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.328] lstrlenW (lpString=".1cd") returned 4
	[0093.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.328] lstrlenW (lpString=".jpg") returned 4
	[0093.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.329] lstrlenW (lpString=".doc") returned 4
	[0093.329] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.329] lstrlenW (lpString=".docx") returned 5
	[0093.329] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0093.329] lstrlenW (lpString=".pdf") returned 4
	[0093.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.330] lstrlenW (lpString=".xls") returned 4
	[0093.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.330] lstrlenW (lpString=".xlsx") returned 5
	[0093.330] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0093.330] lstrlenW (lpString=".ppt") returned 4
	[0093.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.330] lstrlenW (lpString=".zip") returned 4
	[0093.331] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.331] lstrlenW (lpString=".rar") returned 4
	[0093.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.331] lstrlenW (lpString=".bz2") returned 4
	[0093.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.331] lstrlenW (lpString=".7z") returned 3
	[0093.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.332] lstrlenW (lpString=".dbf") returned 4
	[0093.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.332] lstrlenW (lpString=".1cd") returned 4
	[0093.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0093.332] lstrlenW (lpString=".jpg") returned 4
	[0093.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.333] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0093.333] lstrlenW (lpString="AccessMUI.XML") returned 13
	[0093.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0093.360] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1349) returned 1
	[0093.360] CloseHandle (hObject=0x1fc) returned 1
	[0093.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20
	[0093.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0093.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0093.361] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.361] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0093.362] GetLastError () returned 0x0
	[0093.362] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x545, lpOverlapped=0x0) returned 1
	[0093.937] WriteFile (in: hFile=0x20c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0094.098] ReadFile (in: hFile=0x1fc, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.098] WriteFile (in: hFile=0x20c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0094.098] SetEndOfFile (hFile=0x20c) returned 1
	[0094.099] CloseHandle (hObject=0x20c) returned 1
	[0094.167] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.168] SetEndOfFile (hFile=0x1fc) returned 1
	[0094.183] CloseHandle (hObject=0x1fc) returned 1
	[0094.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0094.184] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1
	[0094.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.185] lstrlenW (lpString=".doc") returned 4
	[0094.186] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.186] lstrlenW (lpString=".docx") returned 5
	[0094.186] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0094.186] lstrlenW (lpString=".pdf") returned 4
	[0094.186] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.186] lstrlenW (lpString=".xls") returned 4
	[0094.187] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.187] lstrlenW (lpString=".xlsx") returned 5
	[0094.187] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0094.187] lstrlenW (lpString=".ppt") returned 4
	[0094.187] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.188] lstrlenW (lpString=".zip") returned 4
	[0094.188] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.188] lstrlenW (lpString=".rar") returned 4
	[0094.188] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.188] lstrlenW (lpString=".bz2") returned 4
	[0094.188] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.188] lstrlenW (lpString=".7z") returned 3
	[0094.189] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.189] lstrlenW (lpString=".dbf") returned 4
	[0094.189] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.189] lstrlenW (lpString=".1cd") returned 4
	[0094.189] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.190] lstrlenW (lpString=".jpg") returned 4
	[0094.190] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.191] lstrlenW (lpString=".doc") returned 4
	[0094.191] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.191] lstrlenW (lpString=".docx") returned 5
	[0094.191] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0094.191] lstrlenW (lpString=".pdf") returned 4
	[0094.191] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.192] lstrlenW (lpString=".xls") returned 4
	[0094.192] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.192] lstrlenW (lpString=".xlsx") returned 5
	[0094.192] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0094.192] lstrlenW (lpString=".ppt") returned 4
	[0094.192] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.193] lstrlenW (lpString=".zip") returned 4
	[0094.193] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.676] lstrlenW (lpString=".rar") returned 4
	[0094.676] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.676] lstrlenW (lpString=".bz2") returned 4
	[0094.676] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.677] lstrlenW (lpString=".7z") returned 3
	[0094.677] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.677] lstrlenW (lpString=".dbf") returned 4
	[0094.677] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.678] lstrlenW (lpString=".1cd") returned 4
	[0094.678] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0094.678] lstrlenW (lpString=".jpg") returned 4
	[0094.678] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.679] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0094.680] lstrlenW (lpString="SETUP.XML") returned 9
	[0094.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0095.693] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=2296) returned 1
	[0095.693] CloseHandle (hObject=0x1e0) returned 1
	[0095.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20
	[0095.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0095.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0095.695] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.695] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0095.950] GetLastError () returned 0x0
	[0095.950] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0096.237] WriteFile (in: hFile=0x200, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0096.239] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.239] WriteFile (in: hFile=0x200, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.239] SetEndOfFile (hFile=0x200) returned 1
	[0096.240] CloseHandle (hObject=0x200) returned 1
	[0096.241] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.241] SetEndOfFile (hFile=0x1e0) returned 1
	[0096.244] CloseHandle (hObject=0x1e0) returned 1
	[0096.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0096.245] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1
	[0096.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.246] lstrlenW (lpString=".doc") returned 4
	[0096.246] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.246] lstrlenW (lpString=".docx") returned 5
	[0096.246] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0096.247] lstrlenW (lpString=".pdf") returned 4
	[0096.247] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.247] lstrlenW (lpString=".xls") returned 4
	[0096.247] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.247] lstrlenW (lpString=".xlsx") returned 5
	[0096.247] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0096.247] lstrlenW (lpString=".ppt") returned 4
	[0096.248] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.248] lstrlenW (lpString=".zip") returned 4
	[0096.248] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.248] lstrlenW (lpString=".rar") returned 4
	[0096.248] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.249] lstrlenW (lpString=".bz2") returned 4
	[0096.249] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.249] lstrlenW (lpString=".7z") returned 3
	[0096.249] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.249] lstrlenW (lpString=".dbf") returned 4
	[0096.249] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.250] lstrlenW (lpString=".1cd") returned 4
	[0096.250] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.250] lstrlenW (lpString=".jpg") returned 4
	[0096.250] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.251] lstrlenW (lpString=".doc") returned 4
	[0096.251] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.251] lstrlenW (lpString=".docx") returned 5
	[0096.252] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0096.252] lstrlenW (lpString=".pdf") returned 4
	[0096.252] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.252] lstrlenW (lpString=".xls") returned 4
	[0096.252] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.252] lstrlenW (lpString=".xlsx") returned 5
	[0096.253] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0096.253] lstrlenW (lpString=".ppt") returned 4
	[0096.253] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.253] lstrlenW (lpString=".zip") returned 4
	[0096.253] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.254] lstrlenW (lpString=".rar") returned 4
	[0096.254] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.254] lstrlenW (lpString=".bz2") returned 4
	[0096.254] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.254] lstrlenW (lpString=".7z") returned 3
	[0096.254] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.255] lstrlenW (lpString=".dbf") returned 4
	[0096.255] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.255] lstrlenW (lpString=".1cd") returned 4
	[0096.255] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0096.255] lstrlenW (lpString=".jpg") returned 4
	[0096.256] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.257] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0096.257] lstrlenW (lpString="SETUP.XML") returned 9
	[0096.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0096.257] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1852) returned 1
	[0096.258] CloseHandle (hObject=0x1e0) returned 1
	[0096.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20
	[0096.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0096.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0096.259] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.259] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0096.260] GetLastError () returned 0x0
	[0096.260] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x73c, lpOverlapped=0x0) returned 1
	[0096.419] WriteFile (in: hFile=0x200, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0096.420] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.420] WriteFile (in: hFile=0x200, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.421] SetEndOfFile (hFile=0x200) returned 1
	[0096.421] CloseHandle (hObject=0x200) returned 1
	[0096.426] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.426] SetEndOfFile (hFile=0x1e0) returned 1
	[0096.428] CloseHandle (hObject=0x1e0) returned 1
	[0096.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0096.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1
	[0096.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.430] lstrlenW (lpString=".doc") returned 4
	[0096.430] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.430] lstrlenW (lpString=".docx") returned 5
	[0096.430] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0096.430] lstrlenW (lpString=".pdf") returned 4
	[0096.430] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.430] lstrlenW (lpString=".xls") returned 4
	[0096.431] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.431] lstrlenW (lpString=".xlsx") returned 5
	[0096.431] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0096.431] lstrlenW (lpString=".ppt") returned 4
	[0096.431] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.431] lstrlenW (lpString=".zip") returned 4
	[0096.432] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.432] lstrlenW (lpString=".rar") returned 4
	[0096.432] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.432] lstrlenW (lpString=".bz2") returned 4
	[0096.432] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.432] lstrlenW (lpString=".7z") returned 3
	[0096.433] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.433] lstrlenW (lpString=".dbf") returned 4
	[0096.433] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.434] lstrlenW (lpString=".1cd") returned 4
	[0096.434] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.434] lstrlenW (lpString=".jpg") returned 4
	[0096.434] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.435] lstrlenW (lpString=".doc") returned 4
	[0096.435] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.435] lstrlenW (lpString=".docx") returned 5
	[0096.435] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0096.436] lstrlenW (lpString=".pdf") returned 4
	[0096.436] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.436] lstrlenW (lpString=".xls") returned 4
	[0096.436] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.436] lstrlenW (lpString=".xlsx") returned 5
	[0096.436] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0096.437] lstrlenW (lpString=".ppt") returned 4
	[0096.437] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.437] lstrlenW (lpString=".zip") returned 4
	[0096.437] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.437] lstrlenW (lpString=".rar") returned 4
	[0096.438] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.438] lstrlenW (lpString=".bz2") returned 4
	[0096.438] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.438] lstrlenW (lpString=".7z") returned 3
	[0096.438] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.438] lstrlenW (lpString=".dbf") returned 4
	[0096.439] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.439] lstrlenW (lpString=".1cd") returned 4
	[0096.439] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0096.439] lstrlenW (lpString=".jpg") returned 4
	[0096.439] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.441] lstrcmpiW (lpString1=".CHM", lpString2=".lina") returned -1
	[0096.441] lstrlenW (lpString="OCT.CHM") returned 7
	[0096.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0096.525] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=71236) returned 1
	[0096.525] CloseHandle (hObject=0x1e0) returned 1
	[0096.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20
	[0096.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0096.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0096.526] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.526] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0096.527] GetLastError () returned 0x0
	[0096.527] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x11644, lpOverlapped=0x0) returned 1
	[0096.531] WriteFile (in: hFile=0x20c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x11650, lpOverlapped=0x0) returned 1
	[0096.534] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.534] WriteFile (in: hFile=0x20c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0096.534] SetEndOfFile (hFile=0x20c) returned 1
	[0096.535] CloseHandle (hObject=0x20c) returned 1
	[0096.540] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.541] SetEndOfFile (hFile=0x1e0) returned 1
	[0096.543] CloseHandle (hObject=0x1e0) returned 1
	[0096.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0096.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1
	[0096.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.545] lstrlenW (lpString=".doc") returned 4
	[0096.545] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0096.545] lstrlenW (lpString=".docx") returned 5
	[0096.545] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0096.546] lstrlenW (lpString=".pdf") returned 4
	[0096.546] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0096.546] lstrlenW (lpString=".xls") returned 4
	[0096.546] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0096.546] lstrlenW (lpString=".xlsx") returned 5
	[0096.546] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0096.547] lstrlenW (lpString=".ppt") returned 4
	[0096.547] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0096.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.547] lstrlenW (lpString=".zip") returned 4
	[0096.547] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0096.547] lstrlenW (lpString=".rar") returned 4
	[0096.548] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0096.548] lstrlenW (lpString=".bz2") returned 4
	[0096.548] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0096.548] lstrlenW (lpString=".7z") returned 3
	[0096.548] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0096.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.549] lstrlenW (lpString=".dbf") returned 4
	[0096.549] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0096.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.549] lstrlenW (lpString=".1cd") returned 4
	[0096.550] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0096.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.550] lstrlenW (lpString=".jpg") returned 4
	[0096.550] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0096.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.551] lstrlenW (lpString=".doc") returned 4
	[0096.551] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0096.551] lstrlenW (lpString=".docx") returned 5
	[0096.551] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0096.552] lstrlenW (lpString=".pdf") returned 4
	[0096.552] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0096.552] lstrlenW (lpString=".xls") returned 4
	[0096.552] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0096.552] lstrlenW (lpString=".xlsx") returned 5
	[0096.552] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0096.553] lstrlenW (lpString=".ppt") returned 4
	[0096.553] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0096.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.553] lstrlenW (lpString=".zip") returned 4
	[0096.553] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0096.553] lstrlenW (lpString=".rar") returned 4
	[0096.554] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0096.554] lstrlenW (lpString=".bz2") returned 4
	[0096.554] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0096.554] lstrlenW (lpString=".7z") returned 3
	[0096.554] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0096.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.554] lstrlenW (lpString=".dbf") returned 4
	[0096.555] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0096.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.555] lstrlenW (lpString=".1cd") returned 4
	[0096.555] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0096.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0096.555] lstrlenW (lpString=".jpg") returned 4
	[0096.556] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0096.556] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0096.557] lstrlenW (lpString="OfficeMUISet.XML") returned 16
	[0096.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0096.558] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=819) returned 1
	[0096.558] CloseHandle (hObject=0x1e0) returned 1
	[0096.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20
	[0096.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0096.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0096.559] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.559] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0096.560] GetLastError () returned 0x0
	[0096.560] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x333, lpOverlapped=0x0) returned 1
	[0097.115] WriteFile (in: hFile=0x20c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0097.117] ReadFile (in: hFile=0x1e0, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0097.117] WriteFile (in: hFile=0x20c, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0097.117] SetEndOfFile (hFile=0x20c) returned 1
	[0097.118] CloseHandle (hObject=0x20c) returned 1
	[0097.120] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.120] SetEndOfFile (hFile=0x1e0) returned 1
	[0097.122] CloseHandle (hObject=0x1e0) returned 1
	[0097.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0097.123] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1
	[0097.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.124] lstrlenW (lpString=".doc") returned 4
	[0097.124] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0097.125] lstrlenW (lpString=".docx") returned 5
	[0097.125] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0097.125] lstrlenW (lpString=".pdf") returned 4
	[0097.125] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0097.125] lstrlenW (lpString=".xls") returned 4
	[0097.125] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0097.125] lstrlenW (lpString=".xlsx") returned 5
	[0097.126] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0097.126] lstrlenW (lpString=".ppt") returned 4
	[0097.127] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0097.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.127] lstrlenW (lpString=".zip") returned 4
	[0097.127] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0097.128] lstrlenW (lpString=".rar") returned 4
	[0097.128] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0097.128] lstrlenW (lpString=".bz2") returned 4
	[0097.128] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0097.128] lstrlenW (lpString=".7z") returned 3
	[0097.128] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0097.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.129] lstrlenW (lpString=".dbf") returned 4
	[0097.129] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0097.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.129] lstrlenW (lpString=".1cd") returned 4
	[0097.129] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0097.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.130] lstrlenW (lpString=".jpg") returned 4
	[0097.130] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0097.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.131] lstrlenW (lpString=".doc") returned 4
	[0097.131] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0097.131] lstrlenW (lpString=".docx") returned 5
	[0097.131] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0097.131] lstrlenW (lpString=".pdf") returned 4
	[0097.131] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0097.131] lstrlenW (lpString=".xls") returned 4
	[0097.132] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0097.132] lstrlenW (lpString=".xlsx") returned 5
	[0097.132] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0097.132] lstrlenW (lpString=".ppt") returned 4
	[0097.132] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0097.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.132] lstrlenW (lpString=".zip") returned 4
	[0097.133] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0097.133] lstrlenW (lpString=".rar") returned 4
	[0097.133] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0097.133] lstrlenW (lpString=".bz2") returned 4
	[0097.133] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0097.133] lstrlenW (lpString=".7z") returned 3
	[0097.133] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0097.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.134] lstrlenW (lpString=".dbf") returned 4
	[0097.134] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0097.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.134] lstrlenW (lpString=".1cd") returned 4
	[0097.134] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0097.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0097.135] lstrlenW (lpString=".jpg") returned 4
	[0097.135] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0097.136] lstrcmpiW (lpString1=".CHM", lpString2=".lina") returned -1
	[0097.136] lstrlenW (lpString="PSCONFIG.CHM") returned 12
	[0097.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.434] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=37689) returned 1
	[0099.434] CloseHandle (hObject=0x20c) returned 1
	[0099.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20
	[0099.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.435] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.435] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.436] GetLastError () returned 0x0
	[0099.436] ReadFile (in: hFile=0x20c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x9339, lpOverlapped=0x0) returned 1
	[0099.460] WriteFile (in: hFile=0x1e8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x9340, lpOverlapped=0x0) returned 1
	[0099.463] ReadFile (in: hFile=0x20c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.463] WriteFile (in: hFile=0x1e8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0099.464] SetEndOfFile (hFile=0x1e8) returned 1
	[0099.464] CloseHandle (hObject=0x1e8) returned 1
	[0099.465] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.465] SetEndOfFile (hFile=0x20c) returned 1
	[0099.467] CloseHandle (hObject=0x20c) returned 1
	[0099.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0099.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1
	[0099.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.473] lstrlenW (lpString=".doc") returned 4
	[0099.473] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.473] lstrlenW (lpString=".docx") returned 5
	[0099.473] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0099.474] lstrlenW (lpString=".pdf") returned 4
	[0099.474] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.474] lstrlenW (lpString=".xls") returned 4
	[0099.474] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.474] lstrlenW (lpString=".xlsx") returned 5
	[0099.474] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0099.474] lstrlenW (lpString=".ppt") returned 4
	[0099.475] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.475] lstrlenW (lpString=".zip") returned 4
	[0099.475] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.475] lstrlenW (lpString=".rar") returned 4
	[0099.476] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.476] lstrlenW (lpString=".bz2") returned 4
	[0099.476] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.476] lstrlenW (lpString=".7z") returned 3
	[0099.476] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.479] lstrlenW (lpString=".dbf") returned 4
	[0099.480] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.480] lstrlenW (lpString=".1cd") returned 4
	[0099.480] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.480] lstrlenW (lpString=".jpg") returned 4
	[0099.481] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.481] lstrlenW (lpString=".doc") returned 4
	[0099.482] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.483] lstrlenW (lpString=".docx") returned 5
	[0099.483] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0099.483] lstrlenW (lpString=".pdf") returned 4
	[0099.483] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.483] lstrlenW (lpString=".xls") returned 4
	[0099.483] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.483] lstrlenW (lpString=".xlsx") returned 5
	[0099.484] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0099.484] lstrlenW (lpString=".ppt") returned 4
	[0099.484] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.484] lstrlenW (lpString=".zip") returned 4
	[0099.484] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.485] lstrlenW (lpString=".rar") returned 4
	[0099.485] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.485] lstrlenW (lpString=".bz2") returned 4
	[0099.485] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.485] lstrlenW (lpString=".7z") returned 3
	[0099.485] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.486] lstrlenW (lpString=".dbf") returned 4
	[0099.486] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.486] lstrlenW (lpString=".1cd") returned 4
	[0099.486] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0099.487] lstrlenW (lpString=".jpg") returned 4
	[0099.487] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.488] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0099.488] lstrlenW (lpString="SETUP.XML") returned 9
	[0099.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.489] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=9352) returned 1
	[0099.489] CloseHandle (hObject=0x20c) returned 1
	[0099.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20
	[0099.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.490] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.490] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.491] GetLastError () returned 0x0
	[0099.491] ReadFile (in: hFile=0x20c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0099.705] WriteFile (in: hFile=0x1e8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0099.708] ReadFile (in: hFile=0x20c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.708] WriteFile (in: hFile=0x1e8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0099.708] SetEndOfFile (hFile=0x1e8) returned 1
	[0099.709] CloseHandle (hObject=0x1e8) returned 1
	[0099.709] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.709] SetEndOfFile (hFile=0x20c) returned 1
	[0099.711] CloseHandle (hObject=0x20c) returned 1
	[0099.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0099.712] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1
	[0099.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.714] lstrlenW (lpString=".doc") returned 4
	[0099.714] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.714] lstrlenW (lpString=".docx") returned 5
	[0099.714] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.715] lstrlenW (lpString=".pdf") returned 4
	[0099.715] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.715] lstrlenW (lpString=".xls") returned 4
	[0099.715] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.715] lstrlenW (lpString=".xlsx") returned 5
	[0099.716] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.716] lstrlenW (lpString=".ppt") returned 4
	[0099.716] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.716] lstrlenW (lpString=".zip") returned 4
	[0099.716] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.717] lstrlenW (lpString=".rar") returned 4
	[0099.717] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.717] lstrlenW (lpString=".bz2") returned 4
	[0099.717] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.717] lstrlenW (lpString=".7z") returned 3
	[0099.717] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.718] lstrlenW (lpString=".dbf") returned 4
	[0099.718] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.718] lstrlenW (lpString=".1cd") returned 4
	[0099.719] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.719] lstrlenW (lpString=".jpg") returned 4
	[0099.719] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.720] lstrlenW (lpString=".doc") returned 4
	[0099.720] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.721] lstrlenW (lpString=".docx") returned 5
	[0099.721] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0099.721] lstrlenW (lpString=".pdf") returned 4
	[0099.721] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.721] lstrlenW (lpString=".xls") returned 4
	[0099.721] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.722] lstrlenW (lpString=".xlsx") returned 5
	[0099.722] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0099.722] lstrlenW (lpString=".ppt") returned 4
	[0099.722] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.723] lstrlenW (lpString=".zip") returned 4
	[0099.723] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.723] lstrlenW (lpString=".rar") returned 4
	[0099.723] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.723] lstrlenW (lpString=".bz2") returned 4
	[0099.723] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.724] lstrlenW (lpString=".7z") returned 3
	[0099.724] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.724] lstrlenW (lpString=".dbf") returned 4
	[0099.724] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.725] lstrlenW (lpString=".1cd") returned 4
	[0099.725] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0099.725] lstrlenW (lpString=".jpg") returned 4
	[0099.725] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.727] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0099.727] lstrlenW (lpString="Office32WW.XML") returned 14
	[0099.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.728] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=4274) returned 1
	[0099.728] CloseHandle (hObject=0x20c) returned 1
	[0099.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20
	[0099.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.730] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.730] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0099.732] GetLastError () returned 0x0
	[0099.732] ReadFile (in: hFile=0x20c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0099.751] WriteFile (in: hFile=0x1e8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0099.754] ReadFile (in: hFile=0x20c, lpBuffer=0x3120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesRead=0x2b0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.754] WriteFile (in: hFile=0x1e8, lpBuffer=0x3120020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3120020*, lpNumberOfBytesWritten=0x2b0fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0099.755] SetEndOfFile (hFile=0x1e8) returned 1
	[0099.756] CloseHandle (hObject=0x1e8) returned 1
	[0099.757] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.757] SetEndOfFile (hFile=0x20c) returned 1
	[0099.759] CloseHandle (hObject=0x20c) returned 1
	[0099.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0099.760] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1
	[0099.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.761] lstrlenW (lpString=".doc") returned 4
	[0099.761] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.762] lstrlenW (lpString=".docx") returned 5
	[0099.762] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0099.762] lstrlenW (lpString=".pdf") returned 4
	[0099.762] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.763] lstrlenW (lpString=".xls") returned 4
	[0099.763] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.763] lstrlenW (lpString=".xlsx") returned 5
	[0099.763] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0099.763] lstrlenW (lpString=".ppt") returned 4
	[0099.763] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.764] lstrlenW (lpString=".zip") returned 4
	[0099.764] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.764] lstrlenW (lpString=".rar") returned 4
	[0099.764] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.764] lstrlenW (lpString=".bz2") returned 4
	[0099.765] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.765] lstrlenW (lpString=".7z") returned 3
	[0099.765] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.765] lstrlenW (lpString=".dbf") returned 4
	[0099.765] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.766] lstrlenW (lpString=".1cd") returned 4
	[0099.766] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.766] lstrlenW (lpString=".jpg") returned 4
	[0099.766] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.767] lstrlenW (lpString=".doc") returned 4
	[0099.767] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.767] lstrlenW (lpString=".docx") returned 5
	[0099.767] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0099.768] lstrlenW (lpString=".pdf") returned 4
	[0099.768] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.768] lstrlenW (lpString=".xls") returned 4
	[0099.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.768] lstrlenW (lpString=".xlsx") returned 5
	[0099.768] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0099.769] lstrlenW (lpString=".ppt") returned 4
	[0099.769] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.769] lstrlenW (lpString=".zip") returned 4
	[0099.769] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.769] lstrlenW (lpString=".rar") returned 4
	[0099.769] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.770] lstrlenW (lpString=".bz2") returned 4
	[0099.770] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.770] lstrlenW (lpString=".7z") returned 3
	[0099.770] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.770] lstrlenW (lpString=".dbf") returned 4
	[0099.771] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.771] lstrlenW (lpString=".1cd") returned 4
	[0099.771] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0099.771] lstrlenW (lpString=".jpg") returned 4
	[0099.772] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.773] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0099.773] lstrlenW (lpString="OneNoteMUI.XML") returned 14
	[0099.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.774] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b0ff1c | out: lpFileSize=0x2b0ff1c*=1606) returned 1
	[0099.774] CloseHandle (hObject=0x20c) returned 1
	[0099.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20
	[0099.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0099.775] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.776] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 12
	os_tid = 0x6dc

	[0072.511] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3afa40
	[0072.514] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3bfa48
	[0072.515] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b30
	[0072.516] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x330fd0
	[0072.516] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b48
	[0072.516] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3370020
	[0072.518] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b60
	[0072.518] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b60, Size=0x20) returned 0x3398a8
	[0072.519] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b60
	[0072.519] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b60, Size=0x20) returned 0x339858
	[0072.520] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.520] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.521] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff58 | out: OldValue=0x2c4ff58*=0x0) returned 1
	[0072.521] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.521] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3398a8 | out: hHeap=0x2e0000) returned 1
	[0072.521] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.521] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339858 | out: hHeap=0x2e0000) returned 1
	[0072.522] Sleep (dwMilliseconds=0x64) 
	[0073.225] Sleep (dwMilliseconds=0x64) 
	[0073.463] Sleep (dwMilliseconds=0x64) 
	[0074.824] Sleep (dwMilliseconds=0x64) 
	[0074.953] Sleep (dwMilliseconds=0x64) 
	[0075.097] Sleep (dwMilliseconds=0x64) 
	[0075.319] Sleep (dwMilliseconds=0x64) 
	[0075.679] Sleep (dwMilliseconds=0x64) 
	[0075.979] Sleep (dwMilliseconds=0x64) 
	[0076.471] Sleep (dwMilliseconds=0x64) 
	[0076.827] Sleep (dwMilliseconds=0x64) 
	[0076.975] Sleep (dwMilliseconds=0x64) 
	[0077.174] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0077.174] lstrlenW (lpString="Setup.xml") returned 9
	[0077.175] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0077.798] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2296) returned 1
	[0077.798] CloseHandle (hObject=0x1bc) returned 1
	[0077.798] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0077.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0077.799] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.800] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0077.800] GetLastError () returned 0x0
	[0077.801] ReadFile (in: hFile=0x1bc, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0077.825] WriteFile (in: hFile=0x1d4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0077.827] ReadFile (in: hFile=0x1bc, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0077.827] WriteFile (in: hFile=0x1d4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0077.828] SetEndOfFile (hFile=0x1d4) returned 1
	[0077.828] CloseHandle (hObject=0x1d4) returned 1
	[0078.036] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.036] SetEndOfFile (hFile=0x1bc) returned 1
	[0078.038] CloseHandle (hObject=0x1bc) returned 1
	[0078.038] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.039] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0078.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.040] lstrlenW (lpString=".doc") returned 4
	[0078.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.040] lstrlenW (lpString=".docx") returned 5
	[0078.041] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.041] lstrlenW (lpString=".pdf") returned 4
	[0078.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.041] lstrlenW (lpString=".xls") returned 4
	[0078.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.041] lstrlenW (lpString=".xlsx") returned 5
	[0078.041] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.042] lstrlenW (lpString=".ppt") returned 4
	[0078.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.042] lstrlenW (lpString=".zip") returned 4
	[0078.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.042] lstrlenW (lpString=".rar") returned 4
	[0078.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.043] lstrlenW (lpString=".bz2") returned 4
	[0078.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.043] lstrlenW (lpString=".7z") returned 3
	[0078.043] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.044] lstrlenW (lpString=".dbf") returned 4
	[0078.044] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.044] lstrlenW (lpString=".1cd") returned 4
	[0078.044] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.045] lstrlenW (lpString=".jpg") returned 4
	[0078.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.045] lstrlenW (lpString=".doc") returned 4
	[0078.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.046] lstrlenW (lpString=".docx") returned 5
	[0078.046] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0078.046] lstrlenW (lpString=".pdf") returned 4
	[0078.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.046] lstrlenW (lpString=".xls") returned 4
	[0078.047] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.047] lstrlenW (lpString=".xlsx") returned 5
	[0078.047] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0078.047] lstrlenW (lpString=".ppt") returned 4
	[0078.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.048] lstrlenW (lpString=".zip") returned 4
	[0078.048] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.048] lstrlenW (lpString=".rar") returned 4
	[0078.048] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.049] lstrlenW (lpString=".bz2") returned 4
	[0078.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.049] lstrlenW (lpString=".7z") returned 3
	[0078.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.050] lstrlenW (lpString=".dbf") returned 4
	[0078.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.050] lstrlenW (lpString=".1cd") returned 4
	[0078.050] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0078.051] lstrlenW (lpString=".jpg") returned 4
	[0078.051] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.052] Sleep (dwMilliseconds=0x64) 
	[0078.351] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.351] lstrlenW (lpString="WordMUI.xml") returned 11
	[0078.351] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0078.448] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1800) returned 1
	[0078.448] CloseHandle (hObject=0x1f4) returned 1
	[0078.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020
	[0078.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0078.449] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.449] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0078.450] GetLastError () returned 0x0
	[0078.450] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x708, lpOverlapped=0x0) returned 1
	[0078.660] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0078.663] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.663] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0078.663] SetEndOfFile (hFile=0x1f8) returned 1
	[0078.664] CloseHandle (hObject=0x1f8) returned 1
	[0078.670] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.671] SetEndOfFile (hFile=0x1f4) returned 1
	[0078.679] CloseHandle (hObject=0x1f4) returned 1
	[0078.679] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.680] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1
	[0078.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.681] lstrlenW (lpString=".doc") returned 4
	[0078.682] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.682] lstrlenW (lpString=".docx") returned 5
	[0078.682] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.682] lstrlenW (lpString=".pdf") returned 4
	[0078.682] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.683] lstrlenW (lpString=".xls") returned 4
	[0078.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.683] lstrlenW (lpString=".xlsx") returned 5
	[0078.683] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.684] lstrlenW (lpString=".ppt") returned 4
	[0078.684] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.684] lstrlenW (lpString=".zip") returned 4
	[0078.684] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.684] lstrlenW (lpString=".rar") returned 4
	[0078.685] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.685] lstrlenW (lpString=".bz2") returned 4
	[0078.685] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.685] lstrlenW (lpString=".7z") returned 3
	[0078.685] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.686] lstrlenW (lpString=".dbf") returned 4
	[0078.686] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.686] lstrlenW (lpString=".1cd") returned 4
	[0078.686] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.687] lstrlenW (lpString=".jpg") returned 4
	[0078.687] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.688] lstrlenW (lpString=".doc") returned 4
	[0078.688] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.688] lstrlenW (lpString=".docx") returned 5
	[0078.688] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.689] lstrlenW (lpString=".pdf") returned 4
	[0078.689] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.689] lstrlenW (lpString=".xls") returned 4
	[0078.689] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.689] lstrlenW (lpString=".xlsx") returned 5
	[0078.690] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.690] lstrlenW (lpString=".ppt") returned 4
	[0078.690] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.690] lstrlenW (lpString=".zip") returned 4
	[0078.690] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.691] lstrlenW (lpString=".rar") returned 4
	[0078.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.691] lstrlenW (lpString=".bz2") returned 4
	[0078.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.691] lstrlenW (lpString=".7z") returned 3
	[0078.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.692] lstrlenW (lpString=".dbf") returned 4
	[0078.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.692] lstrlenW (lpString=".1cd") returned 4
	[0078.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0078.693] lstrlenW (lpString=".jpg") returned 4
	[0078.693] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.694] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.694] lstrlenW (lpString="Proof.xml") returned 9
	[0078.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0078.695] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1458) returned 1
	[0078.695] CloseHandle (hObject=0x1f4) returned 1
	[0078.696] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020
	[0078.696] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0078.696] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.697] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0078.698] GetLastError () returned 0x0
	[0078.698] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x5b2, lpOverlapped=0x0) returned 1
	[0079.078] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0079.080] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.080] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0079.080] SetEndOfFile (hFile=0x1f8) returned 1
	[0079.081] CloseHandle (hObject=0x1f8) returned 1
	[0079.086] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.086] SetEndOfFile (hFile=0x1f4) returned 1
	[0079.088] CloseHandle (hObject=0x1f4) returned 1
	[0079.088] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.089] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1
	[0079.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.090] lstrlenW (lpString=".doc") returned 4
	[0079.090] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.090] lstrlenW (lpString=".docx") returned 5
	[0079.090] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0079.090] lstrlenW (lpString=".pdf") returned 4
	[0079.091] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.091] lstrlenW (lpString=".xls") returned 4
	[0079.091] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.091] lstrlenW (lpString=".xlsx") returned 5
	[0079.091] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0079.091] lstrlenW (lpString=".ppt") returned 4
	[0079.092] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.092] lstrlenW (lpString=".zip") returned 4
	[0079.092] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.092] lstrlenW (lpString=".rar") returned 4
	[0079.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.093] lstrlenW (lpString=".bz2") returned 4
	[0079.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.093] lstrlenW (lpString=".7z") returned 3
	[0079.093] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.093] lstrlenW (lpString=".dbf") returned 4
	[0079.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.094] lstrlenW (lpString=".1cd") returned 4
	[0079.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.094] lstrlenW (lpString=".jpg") returned 4
	[0079.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.095] lstrlenW (lpString=".doc") returned 4
	[0079.095] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.096] lstrlenW (lpString=".docx") returned 5
	[0079.096] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0079.096] lstrlenW (lpString=".pdf") returned 4
	[0079.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.096] lstrlenW (lpString=".xls") returned 4
	[0079.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.097] lstrlenW (lpString=".xlsx") returned 5
	[0079.097] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0079.097] lstrlenW (lpString=".ppt") returned 4
	[0079.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.097] lstrlenW (lpString=".zip") returned 4
	[0079.098] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.098] lstrlenW (lpString=".rar") returned 4
	[0079.098] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.098] lstrlenW (lpString=".bz2") returned 4
	[0079.098] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.099] lstrlenW (lpString=".7z") returned 3
	[0079.099] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.099] lstrlenW (lpString=".dbf") returned 4
	[0079.099] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.100] lstrlenW (lpString=".1cd") returned 4
	[0079.100] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0079.100] lstrlenW (lpString=".jpg") returned 4
	[0079.101] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.102] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0079.102] lstrlenW (lpString="Setup.xml") returned 9
	[0079.102] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0079.103] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2362) returned 1
	[0079.103] CloseHandle (hObject=0x1f4) returned 1
	[0079.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0079.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0079.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0079.105] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.105] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0079.106] GetLastError () returned 0x0
	[0079.106] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x93a, lpOverlapped=0x0) returned 1
	[0079.405] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x940, lpOverlapped=0x0) returned 1
	[0079.407] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.407] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0079.407] SetEndOfFile (hFile=0x1f8) returned 1
	[0079.408] CloseHandle (hObject=0x1f8) returned 1
	[0079.412] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.413] SetEndOfFile (hFile=0x1f4) returned 1
	[0079.414] CloseHandle (hObject=0x1f4) returned 1
	[0079.415] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.416] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0079.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.417] lstrlenW (lpString=".doc") returned 4
	[0079.417] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.417] lstrlenW (lpString=".docx") returned 5
	[0079.417] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.417] lstrlenW (lpString=".pdf") returned 4
	[0079.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.418] lstrlenW (lpString=".xls") returned 4
	[0079.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.418] lstrlenW (lpString=".xlsx") returned 5
	[0079.418] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.418] lstrlenW (lpString=".ppt") returned 4
	[0079.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.419] lstrlenW (lpString=".zip") returned 4
	[0079.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.419] lstrlenW (lpString=".rar") returned 4
	[0079.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.420] lstrlenW (lpString=".bz2") returned 4
	[0079.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.420] lstrlenW (lpString=".7z") returned 3
	[0079.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.421] lstrlenW (lpString=".dbf") returned 4
	[0079.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.421] lstrlenW (lpString=".1cd") returned 4
	[0079.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.422] lstrlenW (lpString=".jpg") returned 4
	[0079.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.423] lstrlenW (lpString=".doc") returned 4
	[0079.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.423] lstrlenW (lpString=".docx") returned 5
	[0079.423] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.423] lstrlenW (lpString=".pdf") returned 4
	[0079.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.424] lstrlenW (lpString=".xls") returned 4
	[0079.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.425] lstrlenW (lpString=".xlsx") returned 5
	[0079.426] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.426] lstrlenW (lpString=".ppt") returned 4
	[0079.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.426] lstrlenW (lpString=".zip") returned 4
	[0079.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.427] lstrlenW (lpString=".rar") returned 4
	[0079.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.427] lstrlenW (lpString=".bz2") returned 4
	[0079.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.427] lstrlenW (lpString=".7z") returned 3
	[0079.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.428] lstrlenW (lpString=".dbf") returned 4
	[0079.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.428] lstrlenW (lpString=".1cd") returned 4
	[0079.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.429] lstrlenW (lpString=".jpg") returned 4
	[0079.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.430] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0079.430] lstrlenW (lpString="VisioMUI.xml") returned 12
	[0079.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0079.667] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9503) returned 1
	[0079.668] CloseHandle (hObject=0x1f4) returned 1
	[0079.668] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020
	[0079.669] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0079.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0079.669] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.670] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0079.671] GetLastError () returned 0x0
	[0079.671] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x251f, lpOverlapped=0x0) returned 1
	[0080.169] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2520, lpOverlapped=0x0) returned 1
	[0080.171] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.171] WriteFile (in: hFile=0x1f8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0080.171] SetEndOfFile (hFile=0x1f8) returned 1
	[0080.173] CloseHandle (hObject=0x1f8) returned 1
	[0080.176] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.176] SetEndOfFile (hFile=0x1f4) returned 1
	[0080.178] CloseHandle (hObject=0x1f4) returned 1
	[0080.178] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.179] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1
	[0080.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.180] lstrlenW (lpString=".doc") returned 4
	[0080.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.181] lstrlenW (lpString=".docx") returned 5
	[0080.181] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.181] lstrlenW (lpString=".pdf") returned 4
	[0080.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.181] lstrlenW (lpString=".xls") returned 4
	[0080.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.182] lstrlenW (lpString=".xlsx") returned 5
	[0080.182] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.182] lstrlenW (lpString=".ppt") returned 4
	[0080.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.183] lstrlenW (lpString=".zip") returned 4
	[0080.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.183] lstrlenW (lpString=".rar") returned 4
	[0080.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.183] lstrlenW (lpString=".bz2") returned 4
	[0080.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.184] lstrlenW (lpString=".7z") returned 3
	[0080.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.185] lstrlenW (lpString=".dbf") returned 4
	[0080.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.185] lstrlenW (lpString=".1cd") returned 4
	[0080.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.186] lstrlenW (lpString=".jpg") returned 4
	[0080.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.187] lstrlenW (lpString=".doc") returned 4
	[0080.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.187] lstrlenW (lpString=".docx") returned 5
	[0080.187] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.188] lstrlenW (lpString=".pdf") returned 4
	[0080.188] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.188] lstrlenW (lpString=".xls") returned 4
	[0080.188] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.188] lstrlenW (lpString=".xlsx") returned 5
	[0080.188] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.188] lstrlenW (lpString=".ppt") returned 4
	[0080.189] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.189] lstrlenW (lpString=".zip") returned 4
	[0080.189] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.189] lstrlenW (lpString=".rar") returned 4
	[0080.189] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.190] lstrlenW (lpString=".bz2") returned 4
	[0080.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.190] lstrlenW (lpString=".7z") returned 3
	[0080.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.191] lstrlenW (lpString=".dbf") returned 4
	[0080.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.191] lstrlenW (lpString=".1cd") returned 4
	[0080.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0080.192] lstrlenW (lpString=".jpg") returned 4
	[0080.192] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.193] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0080.193] lstrlenW (lpString="Setup.xml") returned 9
	[0080.193] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0080.198] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1872) returned 1
	[0080.198] CloseHandle (hObject=0x1f8) returned 1
	[0080.199] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0080.199] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0080.200] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.200] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0080.201] GetLastError () returned 0x0
	[0080.201] ReadFile (in: hFile=0x1f8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x750, lpOverlapped=0x0) returned 1
	[0080.208] WriteFile (in: hFile=0x1ec, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0080.210] ReadFile (in: hFile=0x1f8, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.210] WriteFile (in: hFile=0x1ec, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0080.210] SetEndOfFile (hFile=0x1ec) returned 1
	[0080.211] CloseHandle (hObject=0x1ec) returned 1
	[0080.212] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.212] SetEndOfFile (hFile=0x1f8) returned 1
	[0080.214] CloseHandle (hObject=0x1f8) returned 1
	[0080.214] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.215] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0080.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.216] lstrlenW (lpString=".doc") returned 4
	[0080.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.216] lstrlenW (lpString=".docx") returned 5
	[0080.217] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0080.217] lstrlenW (lpString=".pdf") returned 4
	[0080.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.217] lstrlenW (lpString=".xls") returned 4
	[0080.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.217] lstrlenW (lpString=".xlsx") returned 5
	[0080.218] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0080.218] lstrlenW (lpString=".ppt") returned 4
	[0080.218] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.218] lstrlenW (lpString=".zip") returned 4
	[0080.218] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.219] lstrlenW (lpString=".rar") returned 4
	[0080.219] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.219] lstrlenW (lpString=".bz2") returned 4
	[0080.219] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.219] lstrlenW (lpString=".7z") returned 3
	[0080.219] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.220] lstrlenW (lpString=".dbf") returned 4
	[0080.220] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.220] lstrlenW (lpString=".1cd") returned 4
	[0080.221] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.221] lstrlenW (lpString=".jpg") returned 4
	[0080.221] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.222] lstrlenW (lpString=".doc") returned 4
	[0080.222] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.222] lstrlenW (lpString=".docx") returned 5
	[0080.222] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0080.223] lstrlenW (lpString=".pdf") returned 4
	[0080.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.223] lstrlenW (lpString=".xls") returned 4
	[0080.223] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.223] lstrlenW (lpString=".xlsx") returned 5
	[0080.223] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0080.223] lstrlenW (lpString=".ppt") returned 4
	[0080.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.224] lstrlenW (lpString=".zip") returned 4
	[0080.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.224] lstrlenW (lpString=".rar") returned 4
	[0080.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.225] lstrlenW (lpString=".bz2") returned 4
	[0080.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.225] lstrlenW (lpString=".7z") returned 3
	[0080.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.225] lstrlenW (lpString=".dbf") returned 4
	[0080.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.226] lstrlenW (lpString=".1cd") returned 4
	[0080.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.226] lstrlenW (lpString=".jpg") returned 4
	[0080.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.227] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0080.228] lstrlenW (lpString="GrooveMUI.xml") returned 13
	[0080.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0080.537] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=913) returned 1
	[0080.537] CloseHandle (hObject=0x1f4) returned 1
	[0080.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020
	[0080.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0080.541] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.541] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0080.542] GetLastError () returned 0x0
	[0080.542] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x391, lpOverlapped=0x0) returned 1
	[0080.550] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0080.552] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.552] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0080.552] SetEndOfFile (hFile=0x1e0) returned 1
	[0080.553] CloseHandle (hObject=0x1e0) returned 1
	[0080.556] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.557] SetEndOfFile (hFile=0x1f4) returned 1
	[0080.558] CloseHandle (hObject=0x1f4) returned 1
	[0080.575] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.576] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1
	[0080.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.577] lstrlenW (lpString=".doc") returned 4
	[0080.577] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.577] lstrlenW (lpString=".docx") returned 5
	[0080.578] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.578] lstrlenW (lpString=".pdf") returned 4
	[0080.578] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.578] lstrlenW (lpString=".xls") returned 4
	[0080.578] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.578] lstrlenW (lpString=".xlsx") returned 5
	[0080.579] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.579] lstrlenW (lpString=".ppt") returned 4
	[0080.579] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.579] lstrlenW (lpString=".zip") returned 4
	[0080.579] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.580] lstrlenW (lpString=".rar") returned 4
	[0080.580] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.580] lstrlenW (lpString=".bz2") returned 4
	[0080.580] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.580] lstrlenW (lpString=".7z") returned 3
	[0080.580] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.581] lstrlenW (lpString=".dbf") returned 4
	[0080.581] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.581] lstrlenW (lpString=".1cd") returned 4
	[0080.581] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.582] lstrlenW (lpString=".jpg") returned 4
	[0080.582] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.582] lstrlenW (lpString=".doc") returned 4
	[0080.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.583] lstrlenW (lpString=".docx") returned 5
	[0080.583] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0080.583] lstrlenW (lpString=".pdf") returned 4
	[0080.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.583] lstrlenW (lpString=".xls") returned 4
	[0080.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.584] lstrlenW (lpString=".xlsx") returned 5
	[0080.584] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0080.584] lstrlenW (lpString=".ppt") returned 4
	[0080.584] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.584] lstrlenW (lpString=".zip") returned 4
	[0080.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.585] lstrlenW (lpString=".rar") returned 4
	[0080.585] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.585] lstrlenW (lpString=".bz2") returned 4
	[0080.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.585] lstrlenW (lpString=".7z") returned 3
	[0080.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.586] lstrlenW (lpString=".dbf") returned 4
	[0080.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.586] lstrlenW (lpString=".1cd") returned 4
	[0080.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0080.587] lstrlenW (lpString=".jpg") returned 4
	[0080.587] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.588] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0080.588] lstrlenW (lpString="OfficeMUI.xml") returned 13
	[0080.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0080.589] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5557) returned 1
	[0080.589] CloseHandle (hObject=0x1f4) returned 1
	[0080.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020
	[0080.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.590] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0080.590] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.591] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0080.592] GetLastError () returned 0x0
	[0080.592] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0080.827] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0080.829] ReadFile (in: hFile=0x1f4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.829] WriteFile (in: hFile=0x1e0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0080.830] SetEndOfFile (hFile=0x1e0) returned 1
	[0080.830] CloseHandle (hObject=0x1e0) returned 1
	[0080.832] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.832] SetEndOfFile (hFile=0x1f4) returned 1
	[0080.834] CloseHandle (hObject=0x1f4) returned 1
	[0080.834] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.835] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1
	[0081.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.364] lstrlenW (lpString=".doc") returned 4
	[0081.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.364] lstrlenW (lpString=".docx") returned 5
	[0081.364] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0081.364] lstrlenW (lpString=".pdf") returned 4
	[0081.364] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.364] lstrlenW (lpString=".xls") returned 4
	[0081.364] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.364] lstrlenW (lpString=".xlsx") returned 5
	[0081.365] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0081.365] lstrlenW (lpString=".ppt") returned 4
	[0081.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.365] lstrlenW (lpString=".zip") returned 4
	[0081.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.365] lstrlenW (lpString=".rar") returned 4
	[0081.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.365] lstrlenW (lpString=".bz2") returned 4
	[0081.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.366] lstrlenW (lpString=".7z") returned 3
	[0081.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.366] lstrlenW (lpString=".dbf") returned 4
	[0081.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.366] lstrlenW (lpString=".1cd") returned 4
	[0081.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.367] lstrlenW (lpString=".jpg") returned 4
	[0081.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.367] lstrlenW (lpString=".doc") returned 4
	[0081.368] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.368] lstrlenW (lpString=".docx") returned 5
	[0081.368] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0081.368] lstrlenW (lpString=".pdf") returned 4
	[0081.368] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.368] lstrlenW (lpString=".xls") returned 4
	[0081.368] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.368] lstrlenW (lpString=".xlsx") returned 5
	[0081.369] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0081.369] lstrlenW (lpString=".ppt") returned 4
	[0081.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.369] lstrlenW (lpString=".zip") returned 4
	[0081.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.369] lstrlenW (lpString=".rar") returned 4
	[0081.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.370] lstrlenW (lpString=".bz2") returned 4
	[0081.370] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.370] lstrlenW (lpString=".7z") returned 3
	[0081.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.370] lstrlenW (lpString=".dbf") returned 4
	[0081.371] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.371] lstrlenW (lpString=".1cd") returned 4
	[0081.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0081.371] lstrlenW (lpString=".jpg") returned 4
	[0081.371] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.372] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0081.372] lstrlenW (lpString="AccessMUI.xml") returned 13
	[0081.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0082.365] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1349) returned 1
	[0082.365] CloseHandle (hObject=0x1d4) returned 1
	[0082.365] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020
	[0082.366] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0082.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0082.366] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.366] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0082.367] GetLastError () returned 0x0
	[0082.368] ReadFile (in: hFile=0x1d4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x545, lpOverlapped=0x0) returned 1
	[0082.381] WriteFile (in: hFile=0x214, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0082.382] ReadFile (in: hFile=0x1d4, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0082.383] WriteFile (in: hFile=0x214, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0082.383] SetEndOfFile (hFile=0x214) returned 1
	[0082.383] CloseHandle (hObject=0x214) returned 1
	[0082.388] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0082.389] SetEndOfFile (hFile=0x1d4) returned 1
	[0082.390] CloseHandle (hObject=0x1d4) returned 1
	[0082.390] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0082.391] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1
	[0082.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.392] lstrlenW (lpString=".doc") returned 4
	[0082.392] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.392] lstrlenW (lpString=".docx") returned 5
	[0082.392] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0082.393] lstrlenW (lpString=".pdf") returned 4
	[0082.393] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.393] lstrlenW (lpString=".xls") returned 4
	[0082.393] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.393] lstrlenW (lpString=".xlsx") returned 5
	[0082.393] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0082.393] lstrlenW (lpString=".ppt") returned 4
	[0082.393] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.394] lstrlenW (lpString=".zip") returned 4
	[0082.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.394] lstrlenW (lpString=".rar") returned 4
	[0082.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.394] lstrlenW (lpString=".bz2") returned 4
	[0082.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.394] lstrlenW (lpString=".7z") returned 3
	[0082.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.395] lstrlenW (lpString=".dbf") returned 4
	[0082.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.395] lstrlenW (lpString=".1cd") returned 4
	[0082.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0082.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.395] lstrlenW (lpString=".jpg") returned 4
	[0082.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0082.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.396] lstrlenW (lpString=".doc") returned 4
	[0082.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0082.396] lstrlenW (lpString=".docx") returned 5
	[0082.397] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0082.397] lstrlenW (lpString=".pdf") returned 4
	[0082.397] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0082.397] lstrlenW (lpString=".xls") returned 4
	[0082.397] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0082.397] lstrlenW (lpString=".xlsx") returned 5
	[0082.397] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0082.397] lstrlenW (lpString=".ppt") returned 4
	[0082.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0082.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.398] lstrlenW (lpString=".zip") returned 4
	[0082.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0082.398] lstrlenW (lpString=".rar") returned 4
	[0082.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0082.398] lstrlenW (lpString=".bz2") returned 4
	[0082.398] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0082.399] lstrlenW (lpString=".7z") returned 3
	[0082.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0082.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.399] lstrlenW (lpString=".dbf") returned 4
	[0082.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0082.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0082.399] lstrlenW (lpString=".1cd") returned 4
	[0083.638] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0083.638] lstrlenW (lpString=".jpg") returned 4
	[0083.638] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.639] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0083.639] lstrlenW (lpString="ProPlusrWW.xml") returned 14
	[0083.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0083.765] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=16852) returned 1
	[0083.765] CloseHandle (hObject=0x1ec) returned 1
	[0083.766] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020
	[0083.766] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0083.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0083.766] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.766] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0083.768] GetLastError () returned 0x0
	[0083.768] ReadFile (in: hFile=0x1ec, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x41d4, lpOverlapped=0x0) returned 1
	[0085.532] WriteFile (in: hFile=0x204, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x41e0, lpOverlapped=0x0) returned 1
	[0086.083] ReadFile (in: hFile=0x1ec, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0086.083] WriteFile (in: hFile=0x204, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0086.084] SetEndOfFile (hFile=0x204) returned 1
	[0086.084] CloseHandle (hObject=0x204) returned 1
	[0086.088] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.088] SetEndOfFile (hFile=0x1ec) returned 1
	[0086.090] CloseHandle (hObject=0x1ec) returned 1
	[0086.090] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0086.091] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1
	[0086.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.092] lstrlenW (lpString=".doc") returned 4
	[0086.092] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0086.092] lstrlenW (lpString=".docx") returned 5
	[0086.092] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0086.092] lstrlenW (lpString=".pdf") returned 4
	[0086.092] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0086.092] lstrlenW (lpString=".xls") returned 4
	[0086.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0086.093] lstrlenW (lpString=".xlsx") returned 5
	[0086.093] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0086.093] lstrlenW (lpString=".ppt") returned 4
	[0086.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0086.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.093] lstrlenW (lpString=".zip") returned 4
	[0086.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0086.094] lstrlenW (lpString=".rar") returned 4
	[0086.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0086.094] lstrlenW (lpString=".bz2") returned 4
	[0086.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0086.094] lstrlenW (lpString=".7z") returned 3
	[0086.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0086.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.095] lstrlenW (lpString=".dbf") returned 4
	[0086.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0086.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.095] lstrlenW (lpString=".1cd") returned 4
	[0086.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0086.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.095] lstrlenW (lpString=".jpg") returned 4
	[0086.096] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0086.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.096] lstrlenW (lpString=".doc") returned 4
	[0086.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0086.096] lstrlenW (lpString=".docx") returned 5
	[0086.097] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0086.097] lstrlenW (lpString=".pdf") returned 4
	[0086.098] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0086.098] lstrlenW (lpString=".xls") returned 4
	[0086.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0086.098] lstrlenW (lpString=".xlsx") returned 5
	[0086.098] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0086.099] lstrlenW (lpString=".ppt") returned 4
	[0086.099] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0086.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.100] lstrlenW (lpString=".zip") returned 4
	[0086.100] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0086.100] lstrlenW (lpString=".rar") returned 4
	[0086.100] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0086.100] lstrlenW (lpString=".bz2") returned 4
	[0086.100] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0086.101] lstrlenW (lpString=".7z") returned 3
	[0086.101] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0086.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.101] lstrlenW (lpString=".dbf") returned 4
	[0086.101] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0086.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.102] lstrlenW (lpString=".1cd") returned 4
	[0086.102] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0086.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0086.102] lstrlenW (lpString=".jpg") returned 4
	[0086.102] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0086.103] lstrcmpiW (lpString1=".GIF", lpString2=".lina") returned -1
	[0086.103] lstrlenW (lpString="MS.GIF") returned 6
	[0086.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0086.893] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1069) returned 1
	[0086.894] CloseHandle (hObject=0x1ec) returned 1
	[0086.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20
	[0086.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0086.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0086.894] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.895] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0086.895] GetLastError () returned 0x0
	[0086.896] ReadFile (in: hFile=0x1ec, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x42d, lpOverlapped=0x0) returned 1
	[0087.161] WriteFile (in: hFile=0x1fc, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x430, lpOverlapped=0x0) returned 1
	[0087.162] ReadFile (in: hFile=0x1ec, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0087.162] WriteFile (in: hFile=0x1fc, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0087.163] SetEndOfFile (hFile=0x1fc) returned 1
	[0087.163] CloseHandle (hObject=0x1fc) returned 1
	[0087.172] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0087.172] SetEndOfFile (hFile=0x1ec) returned 1
	[0087.174] CloseHandle (hObject=0x1ec) returned 1
	[0087.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0087.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1
	[0087.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.176] lstrlenW (lpString=".doc") returned 4
	[0087.176] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.176] lstrlenW (lpString=".docx") returned 5
	[0087.176] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0087.176] lstrlenW (lpString=".pdf") returned 4
	[0087.176] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.176] lstrlenW (lpString=".xls") returned 4
	[0087.177] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.177] lstrlenW (lpString=".xlsx") returned 5
	[0087.177] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0087.177] lstrlenW (lpString=".ppt") returned 4
	[0087.177] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.178] lstrlenW (lpString=".zip") returned 4
	[0087.178] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.178] lstrlenW (lpString=".rar") returned 4
	[0087.178] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.178] lstrlenW (lpString=".bz2") returned 4
	[0087.178] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.178] lstrlenW (lpString=".7z") returned 3
	[0087.178] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.179] lstrlenW (lpString=".dbf") returned 4
	[0087.179] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.179] lstrlenW (lpString=".1cd") returned 4
	[0087.179] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.180] lstrlenW (lpString=".jpg") returned 4
	[0087.180] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.180] lstrlenW (lpString=".doc") returned 4
	[0087.180] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0087.180] lstrlenW (lpString=".docx") returned 5
	[0087.181] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0087.181] lstrlenW (lpString=".pdf") returned 4
	[0087.181] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0087.181] lstrlenW (lpString=".xls") returned 4
	[0087.181] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0087.181] lstrlenW (lpString=".xlsx") returned 5
	[0087.181] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0087.181] lstrlenW (lpString=".ppt") returned 4
	[0087.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0087.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.182] lstrlenW (lpString=".zip") returned 4
	[0087.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0087.182] lstrlenW (lpString=".rar") returned 4
	[0087.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0087.182] lstrlenW (lpString=".bz2") returned 4
	[0087.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0087.182] lstrlenW (lpString=".7z") returned 3
	[0087.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0087.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.183] lstrlenW (lpString=".dbf") returned 4
	[0087.183] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0087.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.183] lstrlenW (lpString=".1cd") returned 4
	[0087.183] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0087.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0087.183] lstrlenW (lpString=".jpg") returned 4
	[0087.183] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0087.184] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0087.184] lstrlenW (lpString="Content.xml") returned 11
	[0087.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0089.788] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=27045) returned 1
	[0089.788] CloseHandle (hObject=0x1c8) returned 1
	[0089.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0089.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.789] lstrlenW (lpString=".doc") returned 4
	[0089.789] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.790] lstrlenW (lpString=".docx") returned 5
	[0089.790] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0089.790] lstrlenW (lpString=".pdf") returned 4
	[0089.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.790] lstrlenW (lpString=".xls") returned 4
	[0089.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.790] lstrlenW (lpString=".xlsx") returned 5
	[0089.790] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0089.790] lstrlenW (lpString=".ppt") returned 4
	[0089.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.791] lstrlenW (lpString=".zip") returned 4
	[0089.791] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.791] lstrlenW (lpString=".rar") returned 4
	[0089.791] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.791] lstrlenW (lpString=".bz2") returned 4
	[0089.791] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.791] lstrlenW (lpString=".7z") returned 3
	[0089.792] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.792] lstrlenW (lpString=".dbf") returned 4
	[0089.792] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.792] lstrlenW (lpString=".1cd") returned 4
	[0089.792] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.792] lstrlenW (lpString=".jpg") returned 4
	[0089.792] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.793] lstrlenW (lpString=".doc") returned 4
	[0089.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0089.793] lstrlenW (lpString=".docx") returned 5
	[0089.793] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0089.793] lstrlenW (lpString=".pdf") returned 4
	[0089.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0089.794] lstrlenW (lpString=".xls") returned 4
	[0089.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0089.794] lstrlenW (lpString=".xlsx") returned 5
	[0089.795] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0089.795] lstrlenW (lpString=".ppt") returned 4
	[0089.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0089.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.795] lstrlenW (lpString=".zip") returned 4
	[0089.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0089.795] lstrlenW (lpString=".rar") returned 4
	[0089.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0089.795] lstrlenW (lpString=".bz2") returned 4
	[0089.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0089.796] lstrlenW (lpString=".7z") returned 3
	[0089.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0089.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.796] lstrlenW (lpString=".dbf") returned 4
	[0089.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0089.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.796] lstrlenW (lpString=".1cd") returned 4
	[0089.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0089.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0089.797] lstrlenW (lpString=".jpg") returned 4
	[0089.797] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0089.797] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0089.798] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0089.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0089.962] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=31744) returned 1
	[0089.962] CloseHandle (hObject=0x200) returned 1
	[0089.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0089.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.963] lstrlenW (lpString=".doc") returned 4
	[0089.963] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.963] lstrlenW (lpString=".docx") returned 5
	[0089.963] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0089.964] lstrlenW (lpString=".pdf") returned 4
	[0089.964] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.964] lstrlenW (lpString=".xls") returned 4
	[0089.964] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.964] lstrlenW (lpString=".xlsx") returned 5
	[0089.964] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0089.964] lstrlenW (lpString=".ppt") returned 4
	[0089.965] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.965] lstrlenW (lpString=".zip") returned 4
	[0089.965] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.965] lstrlenW (lpString=".rar") returned 4
	[0089.965] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.965] lstrlenW (lpString=".bz2") returned 4
	[0089.966] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.966] lstrlenW (lpString=".7z") returned 3
	[0089.966] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.966] lstrlenW (lpString=".dbf") returned 4
	[0089.966] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.967] lstrlenW (lpString=".1cd") returned 4
	[0089.967] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.967] lstrlenW (lpString=".jpg") returned 4
	[0089.967] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0089.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.968] lstrlenW (lpString=".doc") returned 4
	[0089.968] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.968] lstrlenW (lpString=".docx") returned 5
	[0089.968] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0089.969] lstrlenW (lpString=".pdf") returned 4
	[0089.969] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.969] lstrlenW (lpString=".xls") returned 4
	[0089.969] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.969] lstrlenW (lpString=".xlsx") returned 5
	[0089.969] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0089.969] lstrlenW (lpString=".ppt") returned 4
	[0089.970] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.970] lstrlenW (lpString=".zip") returned 4
	[0089.970] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.970] lstrlenW (lpString=".rar") returned 4
	[0089.970] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.970] lstrlenW (lpString=".bz2") returned 4
	[0089.971] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.971] lstrlenW (lpString=".7z") returned 3
	[0089.971] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.971] lstrlenW (lpString=".dbf") returned 4
	[0089.971] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.972] lstrlenW (lpString=".1cd") returned 4
	[0089.972] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0089.972] lstrlenW (lpString=".jpg") returned 4
	[0089.972] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.032] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0090.032] lstrlenW (lpString="join.avi") returned 8
	[0090.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0090.073] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=222208) returned 1
	[0090.073] CloseHandle (hObject=0x200) returned 1
	[0090.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0090.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.075] lstrlenW (lpString=".doc") returned 4
	[0090.075] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.076] lstrlenW (lpString=".docx") returned 5
	[0090.076] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0090.076] lstrlenW (lpString=".pdf") returned 4
	[0090.076] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.076] lstrlenW (lpString=".xls") returned 4
	[0090.076] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.076] lstrlenW (lpString=".xlsx") returned 5
	[0090.077] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0090.077] lstrlenW (lpString=".ppt") returned 4
	[0090.077] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.077] lstrlenW (lpString=".zip") returned 4
	[0090.077] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.077] lstrlenW (lpString=".rar") returned 4
	[0090.078] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.078] lstrlenW (lpString=".bz2") returned 4
	[0090.078] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.078] lstrlenW (lpString=".7z") returned 3
	[0090.078] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.078] lstrlenW (lpString=".dbf") returned 4
	[0090.079] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.079] lstrlenW (lpString=".1cd") returned 4
	[0090.079] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.079] lstrlenW (lpString=".jpg") returned 4
	[0090.079] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.080] lstrlenW (lpString=".doc") returned 4
	[0090.080] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0090.080] lstrlenW (lpString=".docx") returned 5
	[0090.080] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0090.081] lstrlenW (lpString=".pdf") returned 4
	[0090.081] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0090.081] lstrlenW (lpString=".xls") returned 4
	[0090.081] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0090.081] lstrlenW (lpString=".xlsx") returned 5
	[0090.081] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0090.081] lstrlenW (lpString=".ppt") returned 4
	[0090.081] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0090.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.082] lstrlenW (lpString=".zip") returned 4
	[0090.082] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0090.082] lstrlenW (lpString=".rar") returned 4
	[0090.082] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0090.082] lstrlenW (lpString=".bz2") returned 4
	[0090.082] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0090.083] lstrlenW (lpString=".7z") returned 3
	[0090.083] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0090.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.083] lstrlenW (lpString=".dbf") returned 4
	[0090.083] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0090.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.083] lstrlenW (lpString=".1cd") returned 4
	[0090.083] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0090.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65
	[0090.084] lstrlenW (lpString=".jpg") returned 4
	[0090.084] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.085] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.085] lstrlenW (lpString="auxpad.xml") returned 10
	[0090.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.667] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=212) returned 1
	[0090.667] CloseHandle (hObject=0x1f4) returned 1
	[0090.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0090.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.668] lstrlenW (lpString=".doc") returned 4
	[0090.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.669] lstrlenW (lpString=".docx") returned 5
	[0090.669] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0090.669] lstrlenW (lpString=".pdf") returned 4
	[0090.669] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.669] lstrlenW (lpString=".xls") returned 4
	[0090.669] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.669] lstrlenW (lpString=".xlsx") returned 5
	[0090.669] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0090.669] lstrlenW (lpString=".ppt") returned 4
	[0090.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.670] lstrlenW (lpString=".zip") returned 4
	[0090.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.670] lstrlenW (lpString=".rar") returned 4
	[0090.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.670] lstrlenW (lpString=".bz2") returned 4
	[0090.670] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.670] lstrlenW (lpString=".7z") returned 3
	[0090.671] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.671] lstrlenW (lpString=".dbf") returned 4
	[0090.671] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.671] lstrlenW (lpString=".1cd") returned 4
	[0090.671] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.671] lstrlenW (lpString=".jpg") returned 4
	[0090.672] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.672] lstrlenW (lpString=".doc") returned 4
	[0090.672] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.672] lstrlenW (lpString=".docx") returned 5
	[0090.672] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0090.673] lstrlenW (lpString=".pdf") returned 4
	[0090.673] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.673] lstrlenW (lpString=".xls") returned 4
	[0090.673] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.673] lstrlenW (lpString=".xlsx") returned 5
	[0090.673] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0090.673] lstrlenW (lpString=".ppt") returned 4
	[0090.673] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.674] lstrlenW (lpString=".zip") returned 4
	[0090.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.674] lstrlenW (lpString=".rar") returned 4
	[0090.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.674] lstrlenW (lpString=".bz2") returned 4
	[0090.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.674] lstrlenW (lpString=".7z") returned 3
	[0090.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.675] lstrlenW (lpString=".dbf") returned 4
	[0090.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.675] lstrlenW (lpString=".1cd") returned 4
	[0090.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0090.675] lstrlenW (lpString=".jpg") returned 4
	[0090.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.676] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.676] lstrlenW (lpString="keypad.xml") returned 10
	[0090.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.784] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=727) returned 1
	[0090.784] CloseHandle (hObject=0x1f4) returned 1
	[0090.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20
	[0090.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.785] lstrlenW (lpString=".doc") returned 4
	[0090.785] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.786] lstrlenW (lpString=".docx") returned 5
	[0090.786] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0090.786] lstrlenW (lpString=".pdf") returned 4
	[0090.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.786] lstrlenW (lpString=".xls") returned 4
	[0090.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.786] lstrlenW (lpString=".xlsx") returned 5
	[0090.786] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0090.787] lstrlenW (lpString=".ppt") returned 4
	[0090.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.787] lstrlenW (lpString=".zip") returned 4
	[0090.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.787] lstrlenW (lpString=".rar") returned 4
	[0090.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.787] lstrlenW (lpString=".bz2") returned 4
	[0090.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.788] lstrlenW (lpString=".7z") returned 3
	[0090.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.788] lstrlenW (lpString=".dbf") returned 4
	[0090.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.789] lstrlenW (lpString=".1cd") returned 4
	[0090.789] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.789] lstrlenW (lpString=".jpg") returned 4
	[0090.789] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.790] lstrlenW (lpString=".doc") returned 4
	[0090.790] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.790] lstrlenW (lpString=".docx") returned 5
	[0090.790] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0090.790] lstrlenW (lpString=".pdf") returned 4
	[0090.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.790] lstrlenW (lpString=".xls") returned 4
	[0090.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.791] lstrlenW (lpString=".xlsx") returned 5
	[0090.791] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0090.791] lstrlenW (lpString=".ppt") returned 4
	[0090.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.791] lstrlenW (lpString=".zip") returned 4
	[0090.792] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.792] lstrlenW (lpString=".rar") returned 4
	[0090.792] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.792] lstrlenW (lpString=".bz2") returned 4
	[0090.792] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.792] lstrlenW (lpString=".7z") returned 3
	[0090.792] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.793] lstrlenW (lpString=".dbf") returned 4
	[0090.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.793] lstrlenW (lpString=".1cd") returned 4
	[0090.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75
	[0090.794] lstrlenW (lpString=".jpg") returned 4
	[0090.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.795] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.795] lstrlenW (lpString="base_ca.xml") returned 11
	[0090.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0091.355] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3166) returned 1
	[0091.355] CloseHandle (hObject=0x1e0) returned 1
	[0091.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20
	[0091.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0091.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0091.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.356] lstrlenW (lpString=".doc") returned 4
	[0091.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.356] lstrlenW (lpString=".docx") returned 5
	[0091.356] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0091.357] lstrlenW (lpString=".pdf") returned 4
	[0091.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.357] lstrlenW (lpString=".xls") returned 4
	[0091.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.357] lstrlenW (lpString=".xlsx") returned 5
	[0091.357] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0091.357] lstrlenW (lpString=".ppt") returned 4
	[0091.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.358] lstrlenW (lpString=".zip") returned 4
	[0091.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.358] lstrlenW (lpString=".rar") returned 4
	[0091.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.358] lstrlenW (lpString=".bz2") returned 4
	[0091.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.359] lstrlenW (lpString=".7z") returned 3
	[0091.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.359] lstrlenW (lpString=".dbf") returned 4
	[0091.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.359] lstrlenW (lpString=".1cd") returned 4
	[0091.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.360] lstrlenW (lpString=".jpg") returned 4
	[0091.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.361] lstrlenW (lpString=".doc") returned 4
	[0091.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0091.361] lstrlenW (lpString=".docx") returned 5
	[0091.361] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0091.361] lstrlenW (lpString=".pdf") returned 4
	[0091.361] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0091.361] lstrlenW (lpString=".xls") returned 4
	[0091.361] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0091.362] lstrlenW (lpString=".xlsx") returned 5
	[0091.362] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0091.362] lstrlenW (lpString=".ppt") returned 4
	[0091.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0091.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.362] lstrlenW (lpString=".zip") returned 4
	[0091.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0091.362] lstrlenW (lpString=".rar") returned 4
	[0091.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0091.363] lstrlenW (lpString=".bz2") returned 4
	[0091.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0091.363] lstrlenW (lpString=".7z") returned 3
	[0091.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0091.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.363] lstrlenW (lpString=".dbf") returned 4
	[0091.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0091.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.364] lstrlenW (lpString=".1cd") returned 4
	[0091.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0091.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0091.364] lstrlenW (lpString=".jpg") returned 4
	[0091.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0091.365] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0091.365] lstrlenW (lpString="ipsita.xml") returned 10
	[0091.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0092.322] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2526) returned 1
	[0092.322] CloseHandle (hObject=0x1f0) returned 1
	[0092.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20
	[0092.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0092.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.323] lstrlenW (lpString=".doc") returned 4
	[0092.323] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.324] lstrlenW (lpString=".docx") returned 5
	[0092.324] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0092.324] lstrlenW (lpString=".pdf") returned 4
	[0092.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.324] lstrlenW (lpString=".xls") returned 4
	[0092.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.324] lstrlenW (lpString=".xlsx") returned 5
	[0092.325] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0092.325] lstrlenW (lpString=".ppt") returned 4
	[0092.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.326] lstrlenW (lpString=".zip") returned 4
	[0092.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.326] lstrlenW (lpString=".rar") returned 4
	[0092.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.326] lstrlenW (lpString=".bz2") returned 4
	[0092.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.327] lstrlenW (lpString=".7z") returned 3
	[0092.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.327] lstrlenW (lpString=".dbf") returned 4
	[0092.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.327] lstrlenW (lpString=".1cd") returned 4
	[0092.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.328] lstrlenW (lpString=".jpg") returned 4
	[0092.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.328] lstrlenW (lpString=".doc") returned 4
	[0092.329] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.329] lstrlenW (lpString=".docx") returned 5
	[0092.329] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0092.329] lstrlenW (lpString=".pdf") returned 4
	[0092.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.329] lstrlenW (lpString=".xls") returned 4
	[0092.329] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.330] lstrlenW (lpString=".xlsx") returned 5
	[0092.330] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0092.330] lstrlenW (lpString=".ppt") returned 4
	[0092.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.330] lstrlenW (lpString=".zip") returned 4
	[0092.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.330] lstrlenW (lpString=".rar") returned 4
	[0092.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.331] lstrlenW (lpString=".bz2") returned 4
	[0092.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.331] lstrlenW (lpString=".7z") returned 3
	[0092.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.331] lstrlenW (lpString=".dbf") returned 4
	[0092.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.336] lstrlenW (lpString=".1cd") returned 4
	[0092.336] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0092.336] lstrlenW (lpString=".jpg") returned 4
	[0092.336] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.337] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0092.337] lstrlenW (lpString="ipsnld.xml") returned 10
	[0092.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0092.338] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2626) returned 1
	[0092.338] CloseHandle (hObject=0x1f0) returned 1
	[0092.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20
	[0092.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0092.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.340] lstrlenW (lpString=".doc") returned 4
	[0092.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.340] lstrlenW (lpString=".docx") returned 5
	[0092.340] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0092.340] lstrlenW (lpString=".pdf") returned 4
	[0092.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.340] lstrlenW (lpString=".xls") returned 4
	[0092.341] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.341] lstrlenW (lpString=".xlsx") returned 5
	[0092.341] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0092.341] lstrlenW (lpString=".ppt") returned 4
	[0092.341] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.341] lstrlenW (lpString=".zip") returned 4
	[0092.341] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.342] lstrlenW (lpString=".rar") returned 4
	[0092.342] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.342] lstrlenW (lpString=".bz2") returned 4
	[0092.342] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.342] lstrlenW (lpString=".7z") returned 3
	[0092.342] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.343] lstrlenW (lpString=".dbf") returned 4
	[0092.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.343] lstrlenW (lpString=".1cd") returned 4
	[0092.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.346] lstrlenW (lpString=".jpg") returned 4
	[0092.346] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.347] lstrlenW (lpString=".doc") returned 4
	[0092.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.347] lstrlenW (lpString=".docx") returned 5
	[0092.347] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0092.347] lstrlenW (lpString=".pdf") returned 4
	[0092.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.347] lstrlenW (lpString=".xls") returned 4
	[0092.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.348] lstrlenW (lpString=".xlsx") returned 5
	[0092.348] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0092.348] lstrlenW (lpString=".ppt") returned 4
	[0092.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.348] lstrlenW (lpString=".zip") returned 4
	[0092.351] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.351] lstrlenW (lpString=".rar") returned 4
	[0092.351] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.352] lstrlenW (lpString=".bz2") returned 4
	[0092.352] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.352] lstrlenW (lpString=".7z") returned 3
	[0092.352] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.352] lstrlenW (lpString=".dbf") returned 4
	[0092.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.353] lstrlenW (lpString=".1cd") returned 4
	[0092.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61
	[0092.353] lstrlenW (lpString=".jpg") returned 4
	[0092.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.354] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0092.354] lstrlenW (lpString="ipsnor.xml") returned 10
	[0092.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0092.355] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2580) returned 1
	[0092.355] CloseHandle (hObject=0x1f0) returned 1
	[0092.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20
	[0092.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0092.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0092.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.357] lstrlenW (lpString=".doc") returned 4
	[0092.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.357] lstrlenW (lpString=".docx") returned 5
	[0092.357] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0092.357] lstrlenW (lpString=".pdf") returned 4
	[0092.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.357] lstrlenW (lpString=".xls") returned 4
	[0092.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.358] lstrlenW (lpString=".xlsx") returned 5
	[0092.358] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0092.358] lstrlenW (lpString=".ppt") returned 4
	[0092.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.358] lstrlenW (lpString=".zip") returned 4
	[0092.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.360] lstrlenW (lpString=".rar") returned 4
	[0092.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.360] lstrlenW (lpString=".bz2") returned 4
	[0092.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.361] lstrlenW (lpString=".7z") returned 3
	[0092.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.361] lstrlenW (lpString=".dbf") returned 4
	[0092.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.361] lstrlenW (lpString=".1cd") returned 4
	[0092.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.362] lstrlenW (lpString=".jpg") returned 4
	[0092.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.362] lstrlenW (lpString=".doc") returned 4
	[0092.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0092.362] lstrlenW (lpString=".docx") returned 5
	[0092.363] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0092.363] lstrlenW (lpString=".pdf") returned 4
	[0092.364] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0092.364] lstrlenW (lpString=".xls") returned 4
	[0092.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0092.365] lstrlenW (lpString=".xlsx") returned 5
	[0092.365] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0092.365] lstrlenW (lpString=".ppt") returned 4
	[0092.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0092.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.365] lstrlenW (lpString=".zip") returned 4
	[0092.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0092.365] lstrlenW (lpString=".rar") returned 4
	[0092.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0092.366] lstrlenW (lpString=".bz2") returned 4
	[0092.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0092.366] lstrlenW (lpString=".7z") returned 3
	[0092.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0092.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.366] lstrlenW (lpString=".dbf") returned 4
	[0092.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0092.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.367] lstrlenW (lpString=".1cd") returned 4
	[0092.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0092.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61
	[0092.367] lstrlenW (lpString=".jpg") returned 4
	[0092.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0092.368] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0092.368] lstrlenW (lpString="ipsplk.xml") returned 10
	[0092.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0093.172] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2600) returned 1
	[0093.172] CloseHandle (hObject=0x204) returned 1
	[0093.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20
	[0093.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0093.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0093.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.173] lstrlenW (lpString=".doc") returned 4
	[0093.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.173] lstrlenW (lpString=".docx") returned 5
	[0093.173] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1
	[0093.174] lstrlenW (lpString=".pdf") returned 4
	[0093.174] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.174] lstrlenW (lpString=".xls") returned 4
	[0093.174] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.174] lstrlenW (lpString=".xlsx") returned 5
	[0093.174] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1
	[0093.174] lstrlenW (lpString=".ppt") returned 4
	[0093.174] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.174] lstrlenW (lpString=".zip") returned 4
	[0093.174] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.174] lstrlenW (lpString=".rar") returned 4
	[0093.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.175] lstrlenW (lpString=".bz2") returned 4
	[0093.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.175] lstrlenW (lpString=".7z") returned 3
	[0093.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.175] lstrlenW (lpString=".dbf") returned 4
	[0093.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.175] lstrlenW (lpString=".1cd") returned 4
	[0093.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.176] lstrlenW (lpString=".jpg") returned 4
	[0093.176] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.176] lstrlenW (lpString=".doc") returned 4
	[0093.176] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.176] lstrlenW (lpString=".docx") returned 5
	[0093.176] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1
	[0093.176] lstrlenW (lpString=".pdf") returned 4
	[0093.176] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.177] lstrlenW (lpString=".xls") returned 4
	[0093.177] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.177] lstrlenW (lpString=".xlsx") returned 5
	[0093.177] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1
	[0093.177] lstrlenW (lpString=".ppt") returned 4
	[0093.177] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.177] lstrlenW (lpString=".zip") returned 4
	[0093.177] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.177] lstrlenW (lpString=".rar") returned 4
	[0093.177] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.178] lstrlenW (lpString=".bz2") returned 4
	[0093.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.178] lstrlenW (lpString=".7z") returned 3
	[0093.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.178] lstrlenW (lpString=".dbf") returned 4
	[0093.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.178] lstrlenW (lpString=".1cd") returned 4
	[0093.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61
	[0093.179] lstrlenW (lpString=".jpg") returned 4
	[0093.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.179] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0093.179] lstrlenW (lpString="ipsptg.xml") returned 10
	[0093.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0093.180] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2240) returned 1
	[0093.180] CloseHandle (hObject=0x204) returned 1
	[0093.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20
	[0093.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0093.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0093.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.181] lstrlenW (lpString=".doc") returned 4
	[0093.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.181] lstrlenW (lpString=".docx") returned 5
	[0093.181] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0093.182] lstrlenW (lpString=".pdf") returned 4
	[0093.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.182] lstrlenW (lpString=".xls") returned 4
	[0093.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.182] lstrlenW (lpString=".xlsx") returned 5
	[0093.182] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0093.182] lstrlenW (lpString=".ppt") returned 4
	[0093.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.183] lstrlenW (lpString=".zip") returned 4
	[0093.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.183] lstrlenW (lpString=".rar") returned 4
	[0093.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.183] lstrlenW (lpString=".bz2") returned 4
	[0093.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.183] lstrlenW (lpString=".7z") returned 3
	[0093.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.184] lstrlenW (lpString=".dbf") returned 4
	[0093.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.184] lstrlenW (lpString=".1cd") returned 4
	[0093.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.185] lstrlenW (lpString=".jpg") returned 4
	[0093.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.185] lstrlenW (lpString=".doc") returned 4
	[0093.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.186] lstrlenW (lpString=".docx") returned 5
	[0093.186] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0093.186] lstrlenW (lpString=".pdf") returned 4
	[0093.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.186] lstrlenW (lpString=".xls") returned 4
	[0093.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.186] lstrlenW (lpString=".xlsx") returned 5
	[0093.186] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0093.187] lstrlenW (lpString=".ppt") returned 4
	[0093.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.187] lstrlenW (lpString=".zip") returned 4
	[0093.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.187] lstrlenW (lpString=".rar") returned 4
	[0093.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.187] lstrlenW (lpString=".bz2") returned 4
	[0093.188] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.188] lstrlenW (lpString=".7z") returned 3
	[0093.188] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.188] lstrlenW (lpString=".dbf") returned 4
	[0093.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.188] lstrlenW (lpString=".1cd") returned 4
	[0093.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61
	[0093.189] lstrlenW (lpString=".jpg") returned 4
	[0093.189] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.190] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0093.190] lstrlenW (lpString="ipsrom.xml") returned 10
	[0093.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0093.191] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2644) returned 1
	[0093.191] CloseHandle (hObject=0x204) returned 1
	[0093.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20
	[0093.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0093.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0093.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.192] lstrlenW (lpString=".doc") returned 4
	[0093.192] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.192] lstrlenW (lpString=".docx") returned 5
	[0093.192] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1
	[0093.192] lstrlenW (lpString=".pdf") returned 4
	[0093.192] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.192] lstrlenW (lpString=".xls") returned 4
	[0093.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.193] lstrlenW (lpString=".xlsx") returned 5
	[0093.193] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1
	[0093.193] lstrlenW (lpString=".ppt") returned 4
	[0093.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.193] lstrlenW (lpString=".zip") returned 4
	[0093.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.194] lstrlenW (lpString=".rar") returned 4
	[0093.194] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.194] lstrlenW (lpString=".bz2") returned 4
	[0093.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.194] lstrlenW (lpString=".7z") returned 3
	[0093.194] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.195] lstrlenW (lpString=".dbf") returned 4
	[0093.195] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.195] lstrlenW (lpString=".1cd") returned 4
	[0093.196] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.196] lstrlenW (lpString=".jpg") returned 4
	[0093.196] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.196] lstrlenW (lpString=".doc") returned 4
	[0093.197] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.197] lstrlenW (lpString=".docx") returned 5
	[0093.197] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1
	[0093.197] lstrlenW (lpString=".pdf") returned 4
	[0093.197] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.197] lstrlenW (lpString=".xls") returned 4
	[0093.197] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.197] lstrlenW (lpString=".xlsx") returned 5
	[0093.197] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1
	[0093.198] lstrlenW (lpString=".ppt") returned 4
	[0093.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.198] lstrlenW (lpString=".zip") returned 4
	[0093.198] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.198] lstrlenW (lpString=".rar") returned 4
	[0093.198] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.198] lstrlenW (lpString=".bz2") returned 4
	[0093.198] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.199] lstrlenW (lpString=".7z") returned 3
	[0093.199] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.199] lstrlenW (lpString=".dbf") returned 4
	[0093.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.199] lstrlenW (lpString=".1cd") returned 4
	[0093.199] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0093.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61
	[0093.200] lstrlenW (lpString=".jpg") returned 4
	[0093.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0093.201] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0093.201] lstrlenW (lpString="ipsrus.xml") returned 10
	[0093.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0093.202] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2542) returned 1
	[0093.203] CloseHandle (hObject=0x204) returned 1
	[0093.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20
	[0093.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0093.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0093.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0093.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0093.204] lstrlenW (lpString=".doc") returned 4
	[0093.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".docx") returned 5
	[0093.205] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0093.205] lstrlenW (lpString=".pdf") returned 4
	[0093.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".xls") returned 4
	[0093.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0093.205] lstrlenW (lpString=".xlsx") returned 5
	[0093.205] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0093.206] lstrlenW (lpString=".ppt") returned 4
	[0093.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0093.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0093.206] lstrlenW (lpString=".zip") returned 4
	[0093.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0093.206] lstrlenW (lpString=".rar") returned 4
	[0093.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0093.206] lstrlenW (lpString=".bz2") returned 4
	[0093.207] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0093.207] lstrlenW (lpString=".7z") returned 3
	[0093.207] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0093.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61
	[0093.207] lstrlenW (lpString=".dbf") returned 4
	[0093.207] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.350] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1680383) returned 1
	[0093.350] CloseHandle (hObject=0x1f0) returned 1
	[0093.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20
	[0093.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0093.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0093.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0093.353] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1
	[0093.354] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.354] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.196] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.199] ReadFile (in: hFile=0x1f0, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.228] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0094.228] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1
	[0094.229] ReadFile (in: hFile=0x1f0, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.248] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.248] WriteFile (in: hFile=0x1f0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0094.990] SetEndOfFile (hFile=0x1f0) returned 1
	[0094.991] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f53ff0
	[0095.001] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.001] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f53ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53ff0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.167] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.167] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f53ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53ff0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.352] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.352] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f53ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53ff0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.356] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f53ff0 | out: hHeap=0x2e0000) returned 1
	[0095.708] CloseHandle (hObject=0x1f0) returned 1
	[0097.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0097.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.139] lstrlenW (lpString=".doc") returned 4
	[0097.139] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0097.139] lstrlenW (lpString=".docx") returned 5
	[0097.139] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0097.139] lstrlenW (lpString=".pdf") returned 4
	[0097.139] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0097.140] lstrlenW (lpString=".xls") returned 4
	[0097.140] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0097.140] lstrlenW (lpString=".xlsx") returned 5
	[0097.140] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0097.140] lstrlenW (lpString=".ppt") returned 4
	[0097.140] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0097.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.141] lstrlenW (lpString=".zip") returned 4
	[0097.141] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0097.141] lstrlenW (lpString=".rar") returned 4
	[0097.141] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0097.141] lstrlenW (lpString=".bz2") returned 4
	[0097.141] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0097.142] lstrlenW (lpString=".7z") returned 3
	[0097.142] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0097.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.142] lstrlenW (lpString=".dbf") returned 4
	[0097.142] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0097.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.142] lstrlenW (lpString=".1cd") returned 4
	[0097.142] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0097.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.143] lstrlenW (lpString=".jpg") returned 4
	[0097.143] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0097.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.143] lstrlenW (lpString=".doc") returned 4
	[0097.144] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0097.144] lstrlenW (lpString=".docx") returned 5
	[0097.144] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0097.144] lstrlenW (lpString=".pdf") returned 4
	[0097.144] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0097.144] lstrlenW (lpString=".xls") returned 4
	[0097.144] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0097.145] lstrlenW (lpString=".xlsx") returned 5
	[0097.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0097.145] lstrlenW (lpString=".ppt") returned 4
	[0097.145] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0097.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.145] lstrlenW (lpString=".zip") returned 4
	[0097.145] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0097.146] lstrlenW (lpString=".rar") returned 4
	[0097.146] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0097.146] lstrlenW (lpString=".bz2") returned 4
	[0097.146] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0097.146] lstrlenW (lpString=".7z") returned 3
	[0097.146] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0097.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.147] lstrlenW (lpString=".dbf") returned 4
	[0097.147] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0097.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.147] lstrlenW (lpString=".1cd") returned 4
	[0097.147] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0097.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0097.148] lstrlenW (lpString=".jpg") returned 4
	[0097.148] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0097.149] lstrcmpiW (lpString1=".CHM", lpString2=".lina") returned -1
	[0097.149] lstrlenW (lpString="PSS10O.CHM") returned 10
	[0097.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0098.896] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=26929) returned 1
	[0098.896] CloseHandle (hObject=0x1f0) returned 1
	[0098.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20
	[0098.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0098.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0098.897] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.898] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0098.898] GetLastError () returned 0x0
	[0098.899] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x6931, lpOverlapped=0x0) returned 1
	[0098.996] WriteFile (in: hFile=0x200, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6940, lpOverlapped=0x0) returned 1
	[0098.998] ReadFile (in: hFile=0x1f0, lpBuffer=0x3370020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0098.998] WriteFile (in: hFile=0x200, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0098.999] SetEndOfFile (hFile=0x200) returned 1
	[0099.201] CloseHandle (hObject=0x200) returned 1
	[0099.202] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.202] SetEndOfFile (hFile=0x1f0) returned 1
	[0099.204] CloseHandle (hObject=0x1f0) returned 1
	[0099.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0099.205] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) 

Thread:
	id = 13
	os_tid = 0x544

	[0072.524] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x35c0048
	[0072.528] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x35d0050
	[0072.529] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b60
	[0072.529] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x331000
	[0072.529] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b78
	[0072.529] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x36c0020
	[0072.531] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b90
	[0072.532] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b90, Size=0x20) returned 0x339858
	[0072.532] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330b90
	[0072.532] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330b90, Size=0x20) returned 0x3398a8
	[0072.533] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.533] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.533] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff58 | out: OldValue=0x2d8ff58*=0x0) returned 1
	[0072.534] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.534] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339858 | out: hHeap=0x2e0000) returned 1
	[0072.534] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.534] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3398a8 | out: hHeap=0x2e0000) returned 1
	[0072.535] Sleep (dwMilliseconds=0x64) 
	[0073.226] Sleep (dwMilliseconds=0x64) 
	[0073.464] Sleep (dwMilliseconds=0x64) 
	[0074.825] Sleep (dwMilliseconds=0x64) 
	[0074.954] Sleep (dwMilliseconds=0x64) 
	[0075.098] Sleep (dwMilliseconds=0x64) 
	[0075.320] Sleep (dwMilliseconds=0x64) 
	[0075.680] Sleep (dwMilliseconds=0x64) 
	[0075.979] Sleep (dwMilliseconds=0x64) 
	[0076.473] Sleep (dwMilliseconds=0x64) 
	[0076.828] Sleep (dwMilliseconds=0x64) 
	[0076.976] Sleep (dwMilliseconds=0x64) 
	[0077.176] Sleep (dwMilliseconds=0x64) 
	[0077.643] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0077.644] lstrlenW (lpString="Setup.xml") returned 9
	[0077.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0077.646] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1886) returned 1
	[0077.646] CloseHandle (hObject=0x1c0) returned 1
	[0077.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0077.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0077.647] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.647] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0077.648] GetLastError () returned 0x0
	[0077.648] ReadFile (in: hFile=0x1c0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x75e, lpOverlapped=0x0) returned 1
	[0077.693] WriteFile (in: hFile=0x1c4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0077.694] ReadFile (in: hFile=0x1c0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0077.695] WriteFile (in: hFile=0x1c4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0077.695] SetEndOfFile (hFile=0x1c4) returned 1
	[0077.696] CloseHandle (hObject=0x1c4) returned 1
	[0077.700] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0077.700] SetEndOfFile (hFile=0x1c0) returned 1
	[0077.702] CloseHandle (hObject=0x1c0) returned 1
	[0077.703] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0077.703] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0077.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.704] lstrlenW (lpString=".doc") returned 4
	[0077.705] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0077.705] lstrlenW (lpString=".docx") returned 5
	[0077.705] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0077.705] lstrlenW (lpString=".pdf") returned 4
	[0077.705] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0077.705] lstrlenW (lpString=".xls") returned 4
	[0077.705] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0077.706] lstrlenW (lpString=".xlsx") returned 5
	[0077.706] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0077.706] lstrlenW (lpString=".ppt") returned 4
	[0077.706] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0077.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.918] lstrlenW (lpString=".zip") returned 4
	[0077.918] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0077.937] lstrlenW (lpString=".rar") returned 4
	[0077.938] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0077.938] lstrlenW (lpString=".bz2") returned 4
	[0077.939] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0077.939] lstrlenW (lpString=".7z") returned 3
	[0077.939] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0077.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.940] lstrlenW (lpString=".dbf") returned 4
	[0077.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0077.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.940] lstrlenW (lpString=".1cd") returned 4
	[0077.940] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0077.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.940] lstrlenW (lpString=".jpg") returned 4
	[0077.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0077.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.941] lstrlenW (lpString=".doc") returned 4
	[0077.941] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0077.942] lstrlenW (lpString=".docx") returned 5
	[0077.942] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0077.942] lstrlenW (lpString=".pdf") returned 4
	[0077.942] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0077.942] lstrlenW (lpString=".xls") returned 4
	[0077.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0077.942] lstrlenW (lpString=".xlsx") returned 5
	[0077.943] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0077.943] lstrlenW (lpString=".ppt") returned 4
	[0077.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0077.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.943] lstrlenW (lpString=".zip") returned 4
	[0077.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0077.943] lstrlenW (lpString=".rar") returned 4
	[0077.944] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0077.944] lstrlenW (lpString=".bz2") returned 4
	[0077.944] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0077.944] lstrlenW (lpString=".7z") returned 3
	[0077.944] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0077.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.944] lstrlenW (lpString=".dbf") returned 4
	[0077.945] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0077.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.945] lstrlenW (lpString=".1cd") returned 4
	[0077.945] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0077.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0077.945] lstrlenW (lpString=".jpg") returned 4
	[0077.946] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0077.947] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0077.947] lstrlenW (lpString="PublisherMUI.xml") returned 16
	[0077.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0078.247] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1450) returned 1
	[0078.248] CloseHandle (hObject=0x1e4) returned 1
	[0078.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020
	[0078.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0078.249] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.249] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0078.250] GetLastError () returned 0x0
	[0078.250] ReadFile (in: hFile=0x1e4, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0078.253] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0078.255] ReadFile (in: hFile=0x1e4, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.255] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0078.255] SetEndOfFile (hFile=0x1e8) returned 1
	[0078.256] CloseHandle (hObject=0x1e8) returned 1
	[0078.260] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.260] SetEndOfFile (hFile=0x1e4) returned 1
	[0078.262] CloseHandle (hObject=0x1e4) returned 1
	[0078.262] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.263] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1
	[0078.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.263] lstrlenW (lpString=".doc") returned 4
	[0078.264] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.264] lstrlenW (lpString=".docx") returned 5
	[0078.264] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.264] lstrlenW (lpString=".pdf") returned 4
	[0078.264] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.264] lstrlenW (lpString=".xls") returned 4
	[0078.264] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.264] lstrlenW (lpString=".xlsx") returned 5
	[0078.265] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.265] lstrlenW (lpString=".ppt") returned 4
	[0078.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.265] lstrlenW (lpString=".zip") returned 4
	[0078.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.265] lstrlenW (lpString=".rar") returned 4
	[0078.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.266] lstrlenW (lpString=".bz2") returned 4
	[0078.266] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.266] lstrlenW (lpString=".7z") returned 3
	[0078.267] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.267] lstrlenW (lpString=".dbf") returned 4
	[0078.267] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.267] lstrlenW (lpString=".1cd") returned 4
	[0078.267] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.268] lstrlenW (lpString=".jpg") returned 4
	[0078.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.268] lstrlenW (lpString=".doc") returned 4
	[0078.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.269] lstrlenW (lpString=".docx") returned 5
	[0078.269] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.269] lstrlenW (lpString=".pdf") returned 4
	[0078.269] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.269] lstrlenW (lpString=".xls") returned 4
	[0078.269] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.269] lstrlenW (lpString=".xlsx") returned 5
	[0078.270] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.270] lstrlenW (lpString=".ppt") returned 4
	[0078.270] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.270] lstrlenW (lpString=".zip") returned 4
	[0078.270] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.270] lstrlenW (lpString=".rar") returned 4
	[0078.270] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.271] lstrlenW (lpString=".bz2") returned 4
	[0078.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.271] lstrlenW (lpString=".7z") returned 3
	[0078.271] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.271] lstrlenW (lpString=".dbf") returned 4
	[0078.271] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.272] lstrlenW (lpString=".1cd") returned 4
	[0078.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0078.272] lstrlenW (lpString=".jpg") returned 4
	[0078.272] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.273] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.273] lstrlenW (lpString="OutlookMUI.xml") returned 14
	[0078.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0078.275] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3186) returned 1
	[0078.275] CloseHandle (hObject=0x1e4) returned 1
	[0078.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020
	[0078.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0078.276] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.276] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0078.277] GetLastError () returned 0x0
	[0078.277] ReadFile (in: hFile=0x1e4, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xc72, lpOverlapped=0x0) returned 1
	[0078.279] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xc80, lpOverlapped=0x0) returned 1
	[0078.356] ReadFile (in: hFile=0x1e4, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.356] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0078.505] SetEndOfFile (hFile=0x1e8) returned 1
	[0078.506] CloseHandle (hObject=0x1e8) returned 1
	[0078.507] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.507] SetEndOfFile (hFile=0x1e4) returned 1
	[0078.509] CloseHandle (hObject=0x1e4) returned 1
	[0078.509] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.510] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1
	[0078.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.511] lstrlenW (lpString=".doc") returned 4
	[0078.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.511] lstrlenW (lpString=".docx") returned 5
	[0078.511] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.511] lstrlenW (lpString=".pdf") returned 4
	[0078.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.511] lstrlenW (lpString=".xls") returned 4
	[0078.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.512] lstrlenW (lpString=".xlsx") returned 5
	[0078.512] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.512] lstrlenW (lpString=".ppt") returned 4
	[0078.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.512] lstrlenW (lpString=".zip") returned 4
	[0078.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.513] lstrlenW (lpString=".rar") returned 4
	[0078.513] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.513] lstrlenW (lpString=".bz2") returned 4
	[0078.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.513] lstrlenW (lpString=".7z") returned 3
	[0078.514] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.514] lstrlenW (lpString=".dbf") returned 4
	[0078.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.514] lstrlenW (lpString=".1cd") returned 4
	[0078.515] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.515] lstrlenW (lpString=".jpg") returned 4
	[0078.515] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.516] lstrlenW (lpString=".doc") returned 4
	[0078.516] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.516] lstrlenW (lpString=".docx") returned 5
	[0078.516] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0078.516] lstrlenW (lpString=".pdf") returned 4
	[0078.516] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.517] lstrlenW (lpString=".xls") returned 4
	[0078.517] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.517] lstrlenW (lpString=".xlsx") returned 5
	[0078.517] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0078.517] lstrlenW (lpString=".ppt") returned 4
	[0078.517] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.518] lstrlenW (lpString=".zip") returned 4
	[0078.518] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.518] lstrlenW (lpString=".rar") returned 4
	[0078.518] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.518] lstrlenW (lpString=".bz2") returned 4
	[0078.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.518] lstrlenW (lpString=".7z") returned 3
	[0078.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.519] lstrlenW (lpString=".dbf") returned 4
	[0078.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.519] lstrlenW (lpString=".1cd") returned 4
	[0078.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0078.520] lstrlenW (lpString=".jpg") returned 4
	[0078.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.521] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.521] lstrlenW (lpString="Proof.xml") returned 9
	[0078.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0078.645] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1457) returned 1
	[0078.645] CloseHandle (hObject=0x1e0) returned 1
	[0078.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020
	[0078.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0078.647] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.647] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0078.648] GetLastError () returned 0x0
	[0078.648] ReadFile (in: hFile=0x1e0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5b1, lpOverlapped=0x0) returned 1
	[0078.907] WriteFile (in: hFile=0x1d4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0078.909] ReadFile (in: hFile=0x1e0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0078.909] WriteFile (in: hFile=0x1d4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0078.910] SetEndOfFile (hFile=0x1d4) returned 1
	[0078.910] CloseHandle (hObject=0x1d4) returned 1
	[0078.911] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.912] SetEndOfFile (hFile=0x1e0) returned 1
	[0078.913] CloseHandle (hObject=0x1e0) returned 1
	[0078.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0078.915] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1
	[0078.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.916] lstrlenW (lpString=".doc") returned 4
	[0078.916] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.916] lstrlenW (lpString=".docx") returned 5
	[0078.916] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0078.916] lstrlenW (lpString=".pdf") returned 4
	[0078.916] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.916] lstrlenW (lpString=".xls") returned 4
	[0078.917] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.917] lstrlenW (lpString=".xlsx") returned 5
	[0078.917] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0078.917] lstrlenW (lpString=".ppt") returned 4
	[0078.917] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.918] lstrlenW (lpString=".zip") returned 4
	[0078.918] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.918] lstrlenW (lpString=".rar") returned 4
	[0078.918] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.918] lstrlenW (lpString=".bz2") returned 4
	[0078.918] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.918] lstrlenW (lpString=".7z") returned 3
	[0078.919] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.919] lstrlenW (lpString=".dbf") returned 4
	[0078.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.919] lstrlenW (lpString=".1cd") returned 4
	[0078.919] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.920] lstrlenW (lpString=".jpg") returned 4
	[0078.920] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.921] lstrlenW (lpString=".doc") returned 4
	[0078.921] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0078.922] lstrlenW (lpString=".docx") returned 5
	[0078.922] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0078.922] lstrlenW (lpString=".pdf") returned 4
	[0078.922] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0078.922] lstrlenW (lpString=".xls") returned 4
	[0078.922] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0078.923] lstrlenW (lpString=".xlsx") returned 5
	[0078.923] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0078.923] lstrlenW (lpString=".ppt") returned 4
	[0078.923] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0078.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.923] lstrlenW (lpString=".zip") returned 4
	[0078.924] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0078.924] lstrlenW (lpString=".rar") returned 4
	[0078.924] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0078.924] lstrlenW (lpString=".bz2") returned 4
	[0078.924] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0078.924] lstrlenW (lpString=".7z") returned 3
	[0078.924] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0078.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.925] lstrlenW (lpString=".dbf") returned 4
	[0078.925] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0078.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.925] lstrlenW (lpString=".1cd") returned 4
	[0078.925] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0078.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0078.926] lstrlenW (lpString=".jpg") returned 4
	[0078.926] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0078.927] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0078.927] lstrlenW (lpString="Setup.xml") returned 9
	[0078.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0078.928] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5884) returned 1
	[0078.928] CloseHandle (hObject=0x1e0) returned 1
	[0078.928] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0078.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0078.929] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.929] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0078.930] GetLastError () returned 0x0
	[0078.931] ReadFile (in: hFile=0x1e0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x16fc, lpOverlapped=0x0) returned 1
	[0079.108] WriteFile (in: hFile=0x1d4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0079.110] ReadFile (in: hFile=0x1e0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.110] WriteFile (in: hFile=0x1d4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0079.111] SetEndOfFile (hFile=0x1d4) returned 1
	[0079.111] CloseHandle (hObject=0x1d4) returned 1
	[0079.116] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.116] SetEndOfFile (hFile=0x1e0) returned 1
	[0079.118] CloseHandle (hObject=0x1e0) returned 1
	[0079.118] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.119] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0079.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.120] lstrlenW (lpString=".doc") returned 4
	[0079.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.121] lstrlenW (lpString=".docx") returned 5
	[0079.121] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.121] lstrlenW (lpString=".pdf") returned 4
	[0079.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.121] lstrlenW (lpString=".xls") returned 4
	[0079.121] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.122] lstrlenW (lpString=".xlsx") returned 5
	[0079.122] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.122] lstrlenW (lpString=".ppt") returned 4
	[0079.122] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.122] lstrlenW (lpString=".zip") returned 4
	[0079.123] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.123] lstrlenW (lpString=".rar") returned 4
	[0079.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.123] lstrlenW (lpString=".bz2") returned 4
	[0079.123] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.380] lstrlenW (lpString=".7z") returned 3
	[0079.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.381] lstrlenW (lpString=".dbf") returned 4
	[0079.381] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.381] lstrlenW (lpString=".1cd") returned 4
	[0079.382] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.382] lstrlenW (lpString=".jpg") returned 4
	[0079.382] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.383] lstrlenW (lpString=".doc") returned 4
	[0079.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.383] lstrlenW (lpString=".docx") returned 5
	[0079.384] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.384] lstrlenW (lpString=".pdf") returned 4
	[0079.384] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.384] lstrlenW (lpString=".xls") returned 4
	[0079.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.385] lstrlenW (lpString=".xlsx") returned 5
	[0079.385] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.385] lstrlenW (lpString=".ppt") returned 4
	[0079.385] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.386] lstrlenW (lpString=".zip") returned 4
	[0079.386] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.386] lstrlenW (lpString=".rar") returned 4
	[0079.386] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.386] lstrlenW (lpString=".bz2") returned 4
	[0079.386] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.387] lstrlenW (lpString=".7z") returned 3
	[0079.387] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.387] lstrlenW (lpString=".dbf") returned 4
	[0079.387] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.388] lstrlenW (lpString=".1cd") returned 4
	[0079.388] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.388] lstrlenW (lpString=".jpg") returned 4
	[0079.388] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.390] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0079.390] lstrlenW (lpString="Setup.xml") returned 9
	[0079.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0079.391] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1852) returned 1
	[0079.391] CloseHandle (hObject=0x200) returned 1
	[0079.391] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0079.391] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0079.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0079.392] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.392] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0079.393] GetLastError () returned 0x0
	[0079.393] ReadFile (in: hFile=0x200, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x73c, lpOverlapped=0x0) returned 1
	[0079.675] WriteFile (in: hFile=0x1e0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0079.677] ReadFile (in: hFile=0x200, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0079.677] WriteFile (in: hFile=0x1e0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0079.677] SetEndOfFile (hFile=0x1e0) returned 1
	[0079.678] CloseHandle (hObject=0x1e0) returned 1
	[0079.680] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0079.680] SetEndOfFile (hFile=0x200) returned 1
	[0079.683] CloseHandle (hObject=0x200) returned 1
	[0079.683] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.684] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0079.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.686] lstrlenW (lpString=".doc") returned 4
	[0079.686] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.686] lstrlenW (lpString=".docx") returned 5
	[0079.687] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.687] lstrlenW (lpString=".pdf") returned 4
	[0079.687] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.687] lstrlenW (lpString=".xls") returned 4
	[0079.687] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.688] lstrlenW (lpString=".xlsx") returned 5
	[0079.688] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.688] lstrlenW (lpString=".ppt") returned 4
	[0079.688] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.689] lstrlenW (lpString=".zip") returned 4
	[0079.689] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.689] lstrlenW (lpString=".rar") returned 4
	[0079.689] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.689] lstrlenW (lpString=".bz2") returned 4
	[0079.690] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.690] lstrlenW (lpString=".7z") returned 3
	[0079.690] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.691] lstrlenW (lpString=".dbf") returned 4
	[0079.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.691] lstrlenW (lpString=".1cd") returned 4
	[0079.692] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.692] lstrlenW (lpString=".jpg") returned 4
	[0079.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0079.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.693] lstrlenW (lpString=".doc") returned 4
	[0079.694] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0079.694] lstrlenW (lpString=".docx") returned 5
	[0079.694] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0079.694] lstrlenW (lpString=".pdf") returned 4
	[0079.695] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0079.695] lstrlenW (lpString=".xls") returned 4
	[0079.695] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0079.695] lstrlenW (lpString=".xlsx") returned 5
	[0079.695] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0079.696] lstrlenW (lpString=".ppt") returned 4
	[0079.696] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0079.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.696] lstrlenW (lpString=".zip") returned 4
	[0079.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0079.697] lstrlenW (lpString=".rar") returned 4
	[0079.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0079.697] lstrlenW (lpString=".bz2") returned 4
	[0079.698] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0079.698] lstrlenW (lpString=".7z") returned 3
	[0079.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0079.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.698] lstrlenW (lpString=".dbf") returned 4
	[0079.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0079.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.699] lstrlenW (lpString=".1cd") returned 4
	[0079.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0079.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0079.699] lstrlenW (lpString=".jpg") returned 4
	[0079.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.044] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0080.045] lstrlenW (lpString="Setup.xml") returned 9
	[0080.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0080.388] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1988) returned 1
	[0080.389] CloseHandle (hObject=0x1f0) returned 1
	[0080.389] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0080.389] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.389] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0080.390] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.390] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0080.391] GetLastError () returned 0x0
	[0080.391] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x7c4, lpOverlapped=0x0) returned 1
	[0080.594] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7d0, lpOverlapped=0x0) returned 1
	[0080.596] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0080.596] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0080.596] SetEndOfFile (hFile=0x200) returned 1
	[0080.597] CloseHandle (hObject=0x200) returned 1
	[0080.602] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.603] SetEndOfFile (hFile=0x1f0) returned 1
	[0080.604] CloseHandle (hObject=0x1f0) returned 1
	[0080.605] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.605] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0080.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.607] lstrlenW (lpString=".doc") returned 4
	[0080.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.607] lstrlenW (lpString=".docx") returned 5
	[0080.607] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0080.607] lstrlenW (lpString=".pdf") returned 4
	[0080.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.607] lstrlenW (lpString=".xls") returned 4
	[0080.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.608] lstrlenW (lpString=".xlsx") returned 5
	[0080.608] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0080.608] lstrlenW (lpString=".ppt") returned 4
	[0080.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.609] lstrlenW (lpString=".zip") returned 4
	[0080.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.609] lstrlenW (lpString=".rar") returned 4
	[0080.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.609] lstrlenW (lpString=".bz2") returned 4
	[0080.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.610] lstrlenW (lpString=".7z") returned 3
	[0080.610] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.610] lstrlenW (lpString=".dbf") returned 4
	[0080.610] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.610] lstrlenW (lpString=".1cd") returned 4
	[0080.611] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.611] lstrlenW (lpString=".jpg") returned 4
	[0080.611] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.612] lstrlenW (lpString=".doc") returned 4
	[0080.612] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.612] lstrlenW (lpString=".docx") returned 5
	[0080.612] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0080.613] lstrlenW (lpString=".pdf") returned 4
	[0080.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0080.613] lstrlenW (lpString=".xls") returned 4
	[0080.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0080.613] lstrlenW (lpString=".xlsx") returned 5
	[0080.613] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0080.614] lstrlenW (lpString=".ppt") returned 4
	[0080.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0080.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.614] lstrlenW (lpString=".zip") returned 4
	[0080.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0080.614] lstrlenW (lpString=".rar") returned 4
	[0080.615] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0080.615] lstrlenW (lpString=".bz2") returned 4
	[0080.615] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.615] lstrlenW (lpString=".7z") returned 3
	[0080.615] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.616] lstrlenW (lpString=".dbf") returned 4
	[0080.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.616] lstrlenW (lpString=".1cd") returned 4
	[0080.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0080.617] lstrlenW (lpString=".jpg") returned 4
	[0080.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0080.618] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0080.618] lstrlenW (lpString="OfficeMUISet.xml") returned 16
	[0080.618] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0080.619] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=819) returned 1
	[0080.619] CloseHandle (hObject=0x1f0) returned 1
	[0080.619] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020
	[0080.620] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.620] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0080.620] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.621] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0080.694] GetLastError () returned 0x0
	[0080.694] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x333, lpOverlapped=0x0) returned 1
	[0081.099] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0081.101] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0081.101] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0081.102] SetEndOfFile (hFile=0x200) returned 1
	[0081.102] CloseHandle (hObject=0x200) returned 1
	[0081.108] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.108] SetEndOfFile (hFile=0x1f0) returned 1
	[0081.110] CloseHandle (hObject=0x1f0) returned 1
	[0081.110] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0081.111] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1
	[0081.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.112] lstrlenW (lpString=".doc") returned 4
	[0081.112] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.112] lstrlenW (lpString=".docx") returned 5
	[0081.112] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0081.113] lstrlenW (lpString=".pdf") returned 4
	[0081.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.113] lstrlenW (lpString=".xls") returned 4
	[0081.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.113] lstrlenW (lpString=".xlsx") returned 5
	[0081.113] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0081.114] lstrlenW (lpString=".ppt") returned 4
	[0081.114] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.114] lstrlenW (lpString=".zip") returned 4
	[0081.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.114] lstrlenW (lpString=".rar") returned 4
	[0081.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.115] lstrlenW (lpString=".bz2") returned 4
	[0081.115] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.115] lstrlenW (lpString=".7z") returned 3
	[0081.115] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.115] lstrlenW (lpString=".dbf") returned 4
	[0081.116] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.116] lstrlenW (lpString=".1cd") returned 4
	[0081.116] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.116] lstrlenW (lpString=".jpg") returned 4
	[0081.116] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.117] lstrlenW (lpString=".doc") returned 4
	[0081.117] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0081.117] lstrlenW (lpString=".docx") returned 5
	[0081.118] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0081.118] lstrlenW (lpString=".pdf") returned 4
	[0081.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0081.118] lstrlenW (lpString=".xls") returned 4
	[0081.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0081.118] lstrlenW (lpString=".xlsx") returned 5
	[0081.119] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0081.119] lstrlenW (lpString=".ppt") returned 4
	[0081.119] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0081.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.119] lstrlenW (lpString=".zip") returned 4
	[0081.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0081.119] lstrlenW (lpString=".rar") returned 4
	[0081.120] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0081.120] lstrlenW (lpString=".bz2") returned 4
	[0081.120] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0081.120] lstrlenW (lpString=".7z") returned 3
	[0081.121] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0081.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.121] lstrlenW (lpString=".dbf") returned 4
	[0081.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0081.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.121] lstrlenW (lpString=".1cd") returned 4
	[0081.122] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0081.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0081.122] lstrlenW (lpString=".jpg") returned 4
	[0081.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0081.123] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0081.123] lstrlenW (lpString="Setup.xml") returned 9
	[0081.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0081.124] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9352) returned 1
	[0081.124] CloseHandle (hObject=0x1f0) returned 1
	[0081.124] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0081.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0081.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0081.125] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.125] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0081.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0081.126] GetLastError () returned 0x0
	[0081.126] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0083.524] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0083.526] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.526] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0083.526] SetEndOfFile (hFile=0x200) returned 1
	[0083.526] CloseHandle (hObject=0x200) returned 1
	[0083.529] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.529] SetEndOfFile (hFile=0x1f0) returned 1
	[0083.531] CloseHandle (hObject=0x1f0) returned 1
	[0083.531] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0083.532] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0083.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.533] lstrlenW (lpString=".doc") returned 4
	[0083.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.533] lstrlenW (lpString=".docx") returned 5
	[0083.533] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0083.533] lstrlenW (lpString=".pdf") returned 4
	[0083.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.533] lstrlenW (lpString=".xls") returned 4
	[0083.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.534] lstrlenW (lpString=".xlsx") returned 5
	[0083.534] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0083.534] lstrlenW (lpString=".ppt") returned 4
	[0083.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.534] lstrlenW (lpString=".zip") returned 4
	[0083.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.534] lstrlenW (lpString=".rar") returned 4
	[0083.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.535] lstrlenW (lpString=".bz2") returned 4
	[0083.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.535] lstrlenW (lpString=".7z") returned 3
	[0083.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.535] lstrlenW (lpString=".dbf") returned 4
	[0083.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.536] lstrlenW (lpString=".1cd") returned 4
	[0083.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.536] lstrlenW (lpString=".jpg") returned 4
	[0083.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.537] lstrlenW (lpString=".doc") returned 4
	[0083.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.537] lstrlenW (lpString=".docx") returned 5
	[0083.537] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0083.537] lstrlenW (lpString=".pdf") returned 4
	[0083.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.538] lstrlenW (lpString=".xls") returned 4
	[0083.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.538] lstrlenW (lpString=".xlsx") returned 5
	[0083.538] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0083.538] lstrlenW (lpString=".ppt") returned 4
	[0083.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.539] lstrlenW (lpString=".zip") returned 4
	[0083.539] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.539] lstrlenW (lpString=".rar") returned 4
	[0083.539] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.539] lstrlenW (lpString=".bz2") returned 4
	[0083.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.539] lstrlenW (lpString=".7z") returned 3
	[0083.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.540] lstrlenW (lpString=".dbf") returned 4
	[0083.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.540] lstrlenW (lpString=".1cd") returned 4
	[0083.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.541] lstrlenW (lpString=".jpg") returned 4
	[0083.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.542] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0083.542] lstrlenW (lpString="Setup.xml") returned 9
	[0083.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0083.542] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2624) returned 1
	[0083.542] CloseHandle (hObject=0x1f0) returned 1
	[0083.543] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0083.543] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0083.543] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0083.543] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.544] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0083.544] GetLastError () returned 0x0
	[0083.544] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xa40, lpOverlapped=0x0) returned 1
	[0083.618] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0083.619] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0083.619] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0083.620] SetEndOfFile (hFile=0x200) returned 1
	[0083.620] CloseHandle (hObject=0x200) returned 1
	[0083.621] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.621] SetEndOfFile (hFile=0x1f0) returned 1
	[0083.622] CloseHandle (hObject=0x1f0) returned 1
	[0083.623] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0083.623] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0083.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.624] lstrlenW (lpString=".doc") returned 4
	[0083.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.624] lstrlenW (lpString=".docx") returned 5
	[0083.624] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0083.624] lstrlenW (lpString=".pdf") returned 4
	[0083.625] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.625] lstrlenW (lpString=".xls") returned 4
	[0083.625] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.625] lstrlenW (lpString=".xlsx") returned 5
	[0083.625] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0083.625] lstrlenW (lpString=".ppt") returned 4
	[0083.625] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.625] lstrlenW (lpString=".zip") returned 4
	[0083.625] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.626] lstrlenW (lpString=".rar") returned 4
	[0083.626] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.626] lstrlenW (lpString=".bz2") returned 4
	[0083.626] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.626] lstrlenW (lpString=".7z") returned 3
	[0083.626] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.626] lstrlenW (lpString=".dbf") returned 4
	[0083.626] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.627] lstrlenW (lpString=".1cd") returned 4
	[0083.627] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.627] lstrlenW (lpString=".jpg") returned 4
	[0083.627] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.627] lstrlenW (lpString=".doc") returned 4
	[0083.628] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0083.628] lstrlenW (lpString=".docx") returned 5
	[0083.628] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0083.628] lstrlenW (lpString=".pdf") returned 4
	[0083.628] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0083.628] lstrlenW (lpString=".xls") returned 4
	[0083.628] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0083.628] lstrlenW (lpString=".xlsx") returned 5
	[0083.628] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0083.629] lstrlenW (lpString=".ppt") returned 4
	[0083.629] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0083.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.629] lstrlenW (lpString=".zip") returned 4
	[0083.629] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0083.629] lstrlenW (lpString=".rar") returned 4
	[0083.629] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0083.629] lstrlenW (lpString=".bz2") returned 4
	[0083.629] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0083.630] lstrlenW (lpString=".7z") returned 3
	[0083.630] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0083.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.630] lstrlenW (lpString=".dbf") returned 4
	[0083.630] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0083.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.630] lstrlenW (lpString=".1cd") returned 4
	[0083.630] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0083.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0083.631] lstrlenW (lpString=".jpg") returned 4
	[0083.631] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0083.632] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0083.632] lstrlenW (lpString="Office32WW.xml") returned 14
	[0083.632] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0083.634] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4274) returned 1
	[0083.635] CloseHandle (hObject=0x1f0) returned 1
	[0083.635] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0083.635] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0083.635] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0083.635] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.636] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0083.636] GetLastError () returned 0x0
	[0083.636] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0084.824] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0085.728] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.728] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.729] SetEndOfFile (hFile=0x200) returned 1
	[0085.729] CloseHandle (hObject=0x200) returned 1
	[0085.730] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.731] SetEndOfFile (hFile=0x1f0) returned 1
	[0085.732] CloseHandle (hObject=0x1f0) returned 1
	[0085.732] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.733] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0085.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.734] lstrlenW (lpString=".doc") returned 4
	[0085.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.734] lstrlenW (lpString=".docx") returned 5
	[0085.735] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.735] lstrlenW (lpString=".pdf") returned 4
	[0085.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.735] lstrlenW (lpString=".xls") returned 4
	[0085.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.735] lstrlenW (lpString=".xlsx") returned 5
	[0085.735] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.735] lstrlenW (lpString=".ppt") returned 4
	[0085.736] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.736] lstrlenW (lpString=".zip") returned 4
	[0085.736] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.736] lstrlenW (lpString=".rar") returned 4
	[0085.736] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.736] lstrlenW (lpString=".bz2") returned 4
	[0085.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.737] lstrlenW (lpString=".7z") returned 3
	[0085.737] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.737] lstrlenW (lpString=".dbf") returned 4
	[0085.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.738] lstrlenW (lpString=".1cd") returned 4
	[0085.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.738] lstrlenW (lpString=".jpg") returned 4
	[0085.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.739] lstrlenW (lpString=".doc") returned 4
	[0085.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.740] lstrlenW (lpString=".docx") returned 5
	[0085.740] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.740] lstrlenW (lpString=".pdf") returned 4
	[0085.740] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.740] lstrlenW (lpString=".xls") returned 4
	[0085.740] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.741] lstrlenW (lpString=".xlsx") returned 5
	[0085.741] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.741] lstrlenW (lpString=".ppt") returned 4
	[0085.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.741] lstrlenW (lpString=".zip") returned 4
	[0085.741] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.742] lstrlenW (lpString=".rar") returned 4
	[0085.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.742] lstrlenW (lpString=".bz2") returned 4
	[0085.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.742] lstrlenW (lpString=".7z") returned 3
	[0085.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.743] lstrlenW (lpString=".dbf") returned 4
	[0085.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.743] lstrlenW (lpString=".1cd") returned 4
	[0085.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.743] lstrlenW (lpString=".jpg") returned 4
	[0085.744] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.745] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0085.745] lstrlenW (lpString="Setup.xml") returned 9
	[0085.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0085.746] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=31094) returned 1
	[0085.746] CloseHandle (hObject=0x1f0) returned 1
	[0085.746] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0085.746] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0085.747] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.747] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0085.748] GetLastError () returned 0x0
	[0085.748] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x7976, lpOverlapped=0x0) returned 1
	[0085.820] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7980, lpOverlapped=0x0) returned 1
	[0085.822] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.822] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0085.823] SetEndOfFile (hFile=0x200) returned 1
	[0085.823] CloseHandle (hObject=0x200) returned 1
	[0085.827] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.828] SetEndOfFile (hFile=0x1f0) returned 1
	[0085.829] CloseHandle (hObject=0x1f0) returned 1
	[0085.830] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.830] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0085.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.831] lstrlenW (lpString=".doc") returned 4
	[0085.831] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.831] lstrlenW (lpString=".docx") returned 5
	[0085.831] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0085.832] lstrlenW (lpString=".pdf") returned 4
	[0085.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.832] lstrlenW (lpString=".xls") returned 4
	[0085.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.832] lstrlenW (lpString=".xlsx") returned 5
	[0085.832] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0085.833] lstrlenW (lpString=".ppt") returned 4
	[0085.833] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.833] lstrlenW (lpString=".zip") returned 4
	[0085.833] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.833] lstrlenW (lpString=".rar") returned 4
	[0085.833] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.833] lstrlenW (lpString=".bz2") returned 4
	[0085.833] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.834] lstrlenW (lpString=".7z") returned 3
	[0085.834] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.834] lstrlenW (lpString=".dbf") returned 4
	[0085.834] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.834] lstrlenW (lpString=".1cd") returned 4
	[0085.834] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.835] lstrlenW (lpString=".jpg") returned 4
	[0085.835] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.835] lstrlenW (lpString=".doc") returned 4
	[0085.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.836] lstrlenW (lpString=".docx") returned 5
	[0085.836] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0085.836] lstrlenW (lpString=".pdf") returned 4
	[0085.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.836] lstrlenW (lpString=".xls") returned 4
	[0085.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.836] lstrlenW (lpString=".xlsx") returned 5
	[0085.836] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0085.837] lstrlenW (lpString=".ppt") returned 4
	[0085.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.837] lstrlenW (lpString=".zip") returned 4
	[0085.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.837] lstrlenW (lpString=".rar") returned 4
	[0085.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.837] lstrlenW (lpString=".bz2") returned 4
	[0085.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.838] lstrlenW (lpString=".7z") returned 3
	[0085.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.838] lstrlenW (lpString=".dbf") returned 4
	[0085.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.838] lstrlenW (lpString=".1cd") returned 4
	[0085.839] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0085.839] lstrlenW (lpString=".jpg") returned 4
	[0085.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.840] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0085.840] lstrlenW (lpString="PrjProrWW.xml") returned 13
	[0085.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0085.841] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6421) returned 1
	[0085.841] CloseHandle (hObject=0x1f0) returned 1
	[0085.842] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020
	[0085.842] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0085.842] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.843] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.843] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0085.843] GetLastError () returned 0x0
	[0085.843] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x1915, lpOverlapped=0x0) returned 1
	[0085.893] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0085.895] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.895] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0085.895] SetEndOfFile (hFile=0x200) returned 1
	[0085.896] CloseHandle (hObject=0x200) returned 1
	[0085.900] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.900] SetEndOfFile (hFile=0x1f0) returned 1
	[0085.902] CloseHandle (hObject=0x1f0) returned 1
	[0085.902] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.903] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1
	[0085.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.904] lstrlenW (lpString=".doc") returned 4
	[0085.904] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.904] lstrlenW (lpString=".docx") returned 5
	[0085.904] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.905] lstrlenW (lpString=".pdf") returned 4
	[0085.905] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.905] lstrlenW (lpString=".xls") returned 4
	[0085.905] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.905] lstrlenW (lpString=".xlsx") returned 5
	[0085.905] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.905] lstrlenW (lpString=".ppt") returned 4
	[0085.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.906] lstrlenW (lpString=".zip") returned 4
	[0085.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.906] lstrlenW (lpString=".rar") returned 4
	[0085.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.906] lstrlenW (lpString=".bz2") returned 4
	[0085.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.907] lstrlenW (lpString=".7z") returned 3
	[0085.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.907] lstrlenW (lpString=".dbf") returned 4
	[0085.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.908] lstrlenW (lpString=".1cd") returned 4
	[0085.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.908] lstrlenW (lpString=".jpg") returned 4
	[0085.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.909] lstrlenW (lpString=".doc") returned 4
	[0085.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.909] lstrlenW (lpString=".docx") returned 5
	[0085.909] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.909] lstrlenW (lpString=".pdf") returned 4
	[0085.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.910] lstrlenW (lpString=".xls") returned 4
	[0085.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.910] lstrlenW (lpString=".xlsx") returned 5
	[0085.910] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.911] lstrlenW (lpString=".ppt") returned 4
	[0085.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.911] lstrlenW (lpString=".zip") returned 4
	[0085.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.911] lstrlenW (lpString=".rar") returned 4
	[0085.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.912] lstrlenW (lpString=".bz2") returned 4
	[0085.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.912] lstrlenW (lpString=".7z") returned 3
	[0085.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.912] lstrlenW (lpString=".dbf") returned 4
	[0085.912] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.913] lstrlenW (lpString=".1cd") returned 4
	[0085.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0085.913] lstrlenW (lpString=".jpg") returned 4
	[0085.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.914] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0085.915] lstrlenW (lpString="Office32WW.xml") returned 14
	[0085.915] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0085.917] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4274) returned 1
	[0085.917] CloseHandle (hObject=0x1f0) returned 1
	[0085.917] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0085.917] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0085.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0085.919] GetLastError () returned 0x0
	[0085.919] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0085.955] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0085.957] ReadFile (in: hFile=0x1f0, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0085.957] WriteFile (in: hFile=0x200, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0085.958] SetEndOfFile (hFile=0x200) returned 1
	[0085.958] CloseHandle (hObject=0x200) returned 1
	[0085.960] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0085.960] SetEndOfFile (hFile=0x1f0) returned 1
	[0085.962] CloseHandle (hObject=0x1f0) returned 1
	[0085.962] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.963] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0085.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.964] lstrlenW (lpString=".doc") returned 4
	[0085.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.964] lstrlenW (lpString=".docx") returned 5
	[0085.964] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.965] lstrlenW (lpString=".pdf") returned 4
	[0085.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.965] lstrlenW (lpString=".xls") returned 4
	[0085.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.965] lstrlenW (lpString=".xlsx") returned 5
	[0085.965] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.965] lstrlenW (lpString=".ppt") returned 4
	[0085.966] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.966] lstrlenW (lpString=".zip") returned 4
	[0085.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.966] lstrlenW (lpString=".rar") returned 4
	[0085.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.966] lstrlenW (lpString=".bz2") returned 4
	[0085.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.967] lstrlenW (lpString=".7z") returned 3
	[0085.967] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.967] lstrlenW (lpString=".dbf") returned 4
	[0085.967] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0085.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.967] lstrlenW (lpString=".1cd") returned 4
	[0085.968] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0085.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.968] lstrlenW (lpString=".jpg") returned 4
	[0085.968] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0085.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.969] lstrlenW (lpString=".doc") returned 4
	[0085.969] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0085.969] lstrlenW (lpString=".docx") returned 5
	[0085.969] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0085.969] lstrlenW (lpString=".pdf") returned 4
	[0085.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0085.970] lstrlenW (lpString=".xls") returned 4
	[0085.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0085.970] lstrlenW (lpString=".xlsx") returned 5
	[0085.970] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0085.970] lstrlenW (lpString=".ppt") returned 4
	[0085.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0085.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.970] lstrlenW (lpString=".zip") returned 4
	[0085.971] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0085.971] lstrlenW (lpString=".rar") returned 4
	[0085.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0085.971] lstrlenW (lpString=".bz2") returned 4
	[0085.971] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0085.971] lstrlenW (lpString=".7z") returned 3
	[0085.971] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0085.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0085.972] lstrlenW (lpString=".dbf") returned 4
	[0085.972] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0086.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0086.047] lstrlenW (lpString=".1cd") returned 4
	[0086.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0086.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0086.049] lstrlenW (lpString=".jpg") returned 4
	[0086.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0086.051] lstrcmpiW (lpString1=".EPS", lpString2=".lina") returned -1
	[0086.051] lstrlenW (lpString="MS.EPS") returned 6
	[0086.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0086.484] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=15067) returned 1
	[0086.485] CloseHandle (hObject=0x1c8) returned 1
	[0086.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20
	[0086.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0086.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0086.485] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.486] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0086.900] GetLastError () returned 0x0
	[0086.901] ReadFile (in: hFile=0x1c8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x3adb, lpOverlapped=0x0) returned 1
	[0089.272] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x3ae0, lpOverlapped=0x0) returned 1
	[0089.274] ReadFile (in: hFile=0x1c8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.274] WriteFile (in: hFile=0x1f0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0089.274] SetEndOfFile (hFile=0x1f0) returned 1
	[0089.275] CloseHandle (hObject=0x1f0) returned 1
	[0089.276] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.276] SetEndOfFile (hFile=0x1c8) returned 1
	[0089.278] CloseHandle (hObject=0x1c8) returned 1
	[0089.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0089.278] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1
	[0089.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.280] lstrlenW (lpString=".doc") returned 4
	[0089.280] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0089.280] lstrlenW (lpString=".docx") returned 5
	[0089.280] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0089.280] lstrlenW (lpString=".pdf") returned 4
	[0089.280] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0089.280] lstrlenW (lpString=".xls") returned 4
	[0089.281] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0089.281] lstrlenW (lpString=".xlsx") returned 5
	[0089.281] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0089.281] lstrlenW (lpString=".ppt") returned 4
	[0089.281] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0089.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.282] lstrlenW (lpString=".zip") returned 4
	[0089.282] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0089.282] lstrlenW (lpString=".rar") returned 4
	[0089.282] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0089.282] lstrlenW (lpString=".bz2") returned 4
	[0089.282] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0089.282] lstrlenW (lpString=".7z") returned 3
	[0089.283] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0089.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.283] lstrlenW (lpString=".dbf") returned 4
	[0089.283] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0089.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.283] lstrlenW (lpString=".1cd") returned 4
	[0089.284] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0089.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.284] lstrlenW (lpString=".jpg") returned 4
	[0089.284] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0089.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.285] lstrlenW (lpString=".doc") returned 4
	[0089.285] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0089.285] lstrlenW (lpString=".docx") returned 5
	[0089.285] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0089.285] lstrlenW (lpString=".pdf") returned 4
	[0089.286] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0089.286] lstrlenW (lpString=".xls") returned 4
	[0089.286] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0089.286] lstrlenW (lpString=".xlsx") returned 5
	[0089.286] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0089.286] lstrlenW (lpString=".ppt") returned 4
	[0089.286] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0089.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.287] lstrlenW (lpString=".zip") returned 4
	[0089.287] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0089.287] lstrlenW (lpString=".rar") returned 4
	[0089.287] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0089.287] lstrlenW (lpString=".bz2") returned 4
	[0089.287] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0089.288] lstrlenW (lpString=".7z") returned 3
	[0089.288] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0089.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.288] lstrlenW (lpString=".dbf") returned 4
	[0089.288] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0089.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.288] lstrlenW (lpString=".1cd") returned 4
	[0089.289] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0089.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0089.289] lstrlenW (lpString=".jpg") returned 4
	[0089.289] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0089.290] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0089.290] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0089.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0089.904] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=89600) returned 1
	[0089.905] CloseHandle (hObject=0x208) returned 1
	[0089.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0089.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.917] lstrlenW (lpString=".doc") returned 4
	[0089.917] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.918] lstrlenW (lpString=".docx") returned 5
	[0089.918] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0089.918] lstrlenW (lpString=".pdf") returned 4
	[0089.918] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.918] lstrlenW (lpString=".xls") returned 4
	[0089.918] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.919] lstrlenW (lpString=".xlsx") returned 5
	[0089.919] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0089.920] lstrlenW (lpString=".ppt") returned 4
	[0089.920] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.920] lstrlenW (lpString=".zip") returned 4
	[0089.920] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.920] lstrlenW (lpString=".rar") returned 4
	[0089.921] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.921] lstrlenW (lpString=".bz2") returned 4
	[0089.921] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.921] lstrlenW (lpString=".7z") returned 3
	[0089.921] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.921] lstrlenW (lpString=".dbf") returned 4
	[0089.922] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.922] lstrlenW (lpString=".1cd") returned 4
	[0089.922] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.922] lstrlenW (lpString=".jpg") returned 4
	[0089.922] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0089.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.923] lstrlenW (lpString=".doc") returned 4
	[0089.923] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.923] lstrlenW (lpString=".docx") returned 5
	[0089.924] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0089.924] lstrlenW (lpString=".pdf") returned 4
	[0089.924] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.924] lstrlenW (lpString=".xls") returned 4
	[0089.924] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.924] lstrlenW (lpString=".xlsx") returned 5
	[0089.924] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0089.924] lstrlenW (lpString=".ppt") returned 4
	[0089.925] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.925] lstrlenW (lpString=".zip") returned 4
	[0089.925] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.925] lstrlenW (lpString=".rar") returned 4
	[0089.925] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.925] lstrlenW (lpString=".bz2") returned 4
	[0089.925] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.926] lstrlenW (lpString=".7z") returned 3
	[0089.926] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.926] lstrlenW (lpString=".dbf") returned 4
	[0089.926] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.926] lstrlenW (lpString=".1cd") returned 4
	[0089.926] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0089.927] lstrlenW (lpString=".jpg") returned 4
	[0089.927] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0089.928] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0089.928] lstrlenW (lpString="boxed-split.avi") returned 15
	[0089.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0089.929] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=62976) returned 1
	[0089.929] CloseHandle (hObject=0x208) returned 1
	[0089.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0089.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.930] lstrlenW (lpString=".doc") returned 4
	[0089.930] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.930] lstrlenW (lpString=".docx") returned 5
	[0089.931] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0089.931] lstrlenW (lpString=".pdf") returned 4
	[0089.931] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.931] lstrlenW (lpString=".xls") returned 4
	[0089.931] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.931] lstrlenW (lpString=".xlsx") returned 5
	[0089.931] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0089.931] lstrlenW (lpString=".ppt") returned 4
	[0089.932] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.932] lstrlenW (lpString=".zip") returned 4
	[0089.932] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.932] lstrlenW (lpString=".rar") returned 4
	[0089.932] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.932] lstrlenW (lpString=".bz2") returned 4
	[0089.933] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.933] lstrlenW (lpString=".7z") returned 3
	[0089.933] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.933] lstrlenW (lpString=".dbf") returned 4
	[0089.933] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.934] lstrlenW (lpString=".1cd") returned 4
	[0089.934] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.934] lstrlenW (lpString=".jpg") returned 4
	[0089.934] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0089.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.935] lstrlenW (lpString=".doc") returned 4
	[0089.935] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.935] lstrlenW (lpString=".docx") returned 5
	[0089.935] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0089.935] lstrlenW (lpString=".pdf") returned 4
	[0089.935] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.936] lstrlenW (lpString=".xls") returned 4
	[0089.936] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.936] lstrlenW (lpString=".xlsx") returned 5
	[0089.936] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0089.936] lstrlenW (lpString=".ppt") returned 4
	[0089.936] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.937] lstrlenW (lpString=".zip") returned 4
	[0089.937] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.937] lstrlenW (lpString=".rar") returned 4
	[0089.937] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.937] lstrlenW (lpString=".bz2") returned 4
	[0089.937] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.937] lstrlenW (lpString=".7z") returned 3
	[0089.938] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.938] lstrlenW (lpString=".dbf") returned 4
	[0089.938] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.938] lstrlenW (lpString=".1cd") returned 4
	[0089.938] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0089.939] lstrlenW (lpString=".jpg") returned 4
	[0089.939] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0089.940] lstrcmpiW (lpString1=".avi", lpString2=".lina") returned -1
	[0089.940] lstrlenW (lpString="correct.avi") returned 11
	[0089.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0089.941] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=197120) returned 1
	[0089.941] CloseHandle (hObject=0x208) returned 1
	[0089.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0089.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0089.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.942] lstrlenW (lpString=".doc") returned 4
	[0089.942] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.942] lstrlenW (lpString=".docx") returned 5
	[0089.942] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0089.942] lstrlenW (lpString=".pdf") returned 4
	[0089.943] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.943] lstrlenW (lpString=".xls") returned 4
	[0089.943] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.943] lstrlenW (lpString=".xlsx") returned 5
	[0089.943] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0089.943] lstrlenW (lpString=".ppt") returned 4
	[0089.943] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.943] lstrlenW (lpString=".zip") returned 4
	[0089.944] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.944] lstrlenW (lpString=".rar") returned 4
	[0089.944] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.944] lstrlenW (lpString=".bz2") returned 4
	[0089.944] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.944] lstrlenW (lpString=".7z") returned 3
	[0089.944] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.945] lstrlenW (lpString=".dbf") returned 4
	[0089.945] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.945] lstrlenW (lpString=".1cd") returned 4
	[0089.945] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.945] lstrlenW (lpString=".jpg") returned 4
	[0089.945] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0089.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.946] lstrlenW (lpString=".doc") returned 4
	[0089.946] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0089.946] lstrlenW (lpString=".docx") returned 5
	[0089.946] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0089.946] lstrlenW (lpString=".pdf") returned 4
	[0089.947] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0089.947] lstrlenW (lpString=".xls") returned 4
	[0089.947] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0089.947] lstrlenW (lpString=".xlsx") returned 5
	[0089.947] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0089.947] lstrlenW (lpString=".ppt") returned 4
	[0089.947] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0089.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.948] lstrlenW (lpString=".zip") returned 4
	[0089.948] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0089.948] lstrlenW (lpString=".rar") returned 4
	[0089.948] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0089.948] lstrlenW (lpString=".bz2") returned 4
	[0089.948] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0089.948] lstrlenW (lpString=".7z") returned 3
	[0089.948] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0089.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.949] lstrlenW (lpString=".dbf") returned 4
	[0089.949] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0089.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.949] lstrlenW (lpString=".1cd") returned 4
	[0089.949] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0089.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0089.949] lstrlenW (lpString=".jpg") returned 4
	[0089.950] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0090.086] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.086] lstrlenW (lpString="ea.xml") returned 6
	[0090.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.774] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=384) returned 1
	[0090.774] CloseHandle (hObject=0x1f4) returned 1
	[0090.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20
	[0090.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.775] lstrlenW (lpString=".doc") returned 4
	[0090.775] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.775] lstrlenW (lpString=".docx") returned 5
	[0090.775] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0090.776] lstrlenW (lpString=".pdf") returned 4
	[0090.776] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.776] lstrlenW (lpString=".xls") returned 4
	[0090.776] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.776] lstrlenW (lpString=".xlsx") returned 5
	[0090.776] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0090.776] lstrlenW (lpString=".ppt") returned 4
	[0090.776] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.776] lstrlenW (lpString=".zip") returned 4
	[0090.777] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.777] lstrlenW (lpString=".rar") returned 4
	[0090.777] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.777] lstrlenW (lpString=".bz2") returned 4
	[0090.777] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.777] lstrlenW (lpString=".7z") returned 3
	[0090.778] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.778] lstrlenW (lpString=".dbf") returned 4
	[0090.778] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.778] lstrlenW (lpString=".1cd") returned 4
	[0090.778] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.778] lstrlenW (lpString=".jpg") returned 4
	[0090.778] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.779] lstrlenW (lpString=".doc") returned 4
	[0090.779] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.779] lstrlenW (lpString=".docx") returned 5
	[0090.779] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0090.779] lstrlenW (lpString=".pdf") returned 4
	[0090.780] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.780] lstrlenW (lpString=".xls") returned 4
	[0090.780] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.780] lstrlenW (lpString=".xlsx") returned 5
	[0090.780] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0090.780] lstrlenW (lpString=".ppt") returned 4
	[0090.780] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.780] lstrlenW (lpString=".zip") returned 4
	[0090.781] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.781] lstrlenW (lpString=".rar") returned 4
	[0090.781] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.781] lstrlenW (lpString=".bz2") returned 4
	[0090.781] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.781] lstrlenW (lpString=".7z") returned 3
	[0090.781] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.781] lstrlenW (lpString=".dbf") returned 4
	[0090.782] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.782] lstrlenW (lpString=".1cd") returned 4
	[0090.782] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0090.782] lstrlenW (lpString=".jpg") returned 4
	[0090.782] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.783] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.783] lstrlenW (lpString="base_altgr.xml") returned 14
	[0090.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.888] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3161) returned 1
	[0090.888] CloseHandle (hObject=0x1f4) returned 1
	[0090.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20
	[0090.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.890] lstrlenW (lpString=".doc") returned 4
	[0090.891] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.891] lstrlenW (lpString=".docx") returned 5
	[0090.891] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0090.891] lstrlenW (lpString=".pdf") returned 4
	[0090.891] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.891] lstrlenW (lpString=".xls") returned 4
	[0090.892] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.892] lstrlenW (lpString=".xlsx") returned 5
	[0090.892] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0090.892] lstrlenW (lpString=".ppt") returned 4
	[0090.892] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.892] lstrlenW (lpString=".zip") returned 4
	[0090.892] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.893] lstrlenW (lpString=".rar") returned 4
	[0090.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.893] lstrlenW (lpString=".bz2") returned 4
	[0090.893] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.893] lstrlenW (lpString=".7z") returned 3
	[0090.893] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.893] lstrlenW (lpString=".dbf") returned 4
	[0090.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.894] lstrlenW (lpString=".1cd") returned 4
	[0090.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.894] lstrlenW (lpString=".jpg") returned 4
	[0090.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.895] lstrlenW (lpString=".doc") returned 4
	[0090.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.895] lstrlenW (lpString=".docx") returned 5
	[0090.895] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0090.896] lstrlenW (lpString=".pdf") returned 4
	[0090.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.896] lstrlenW (lpString=".xls") returned 4
	[0090.896] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.896] lstrlenW (lpString=".xlsx") returned 5
	[0090.896] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0090.896] lstrlenW (lpString=".ppt") returned 4
	[0090.896] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.897] lstrlenW (lpString=".zip") returned 4
	[0090.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.897] lstrlenW (lpString=".rar") returned 4
	[0090.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.897] lstrlenW (lpString=".bz2") returned 4
	[0090.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.897] lstrlenW (lpString=".7z") returned 3
	[0090.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.898] lstrlenW (lpString=".dbf") returned 4
	[0090.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.898] lstrlenW (lpString=".1cd") returned 4
	[0090.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0090.899] lstrlenW (lpString=".jpg") returned 4
	[0090.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.900] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.900] lstrlenW (lpString="base_heb.xml") returned 12
	[0090.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.915] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=738) returned 1
	[0090.916] CloseHandle (hObject=0x1f4) returned 1
	[0090.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20
	[0090.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.922] lstrlenW (lpString=".doc") returned 4
	[0090.923] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.923] lstrlenW (lpString=".docx") returned 5
	[0090.923] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0090.923] lstrlenW (lpString=".pdf") returned 4
	[0090.923] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.923] lstrlenW (lpString=".xls") returned 4
	[0090.923] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.924] lstrlenW (lpString=".xlsx") returned 5
	[0090.924] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0090.924] lstrlenW (lpString=".ppt") returned 4
	[0090.924] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.924] lstrlenW (lpString=".zip") returned 4
	[0090.924] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.925] lstrlenW (lpString=".rar") returned 4
	[0090.925] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.925] lstrlenW (lpString=".bz2") returned 4
	[0090.925] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.925] lstrlenW (lpString=".7z") returned 3
	[0090.925] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.926] lstrlenW (lpString=".dbf") returned 4
	[0090.926] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.926] lstrlenW (lpString=".1cd") returned 4
	[0090.926] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.926] lstrlenW (lpString=".jpg") returned 4
	[0090.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.927] lstrlenW (lpString=".doc") returned 4
	[0090.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.927] lstrlenW (lpString=".docx") returned 5
	[0090.928] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0090.928] lstrlenW (lpString=".pdf") returned 4
	[0090.928] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.928] lstrlenW (lpString=".xls") returned 4
	[0090.928] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.928] lstrlenW (lpString=".xlsx") returned 5
	[0090.928] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0090.928] lstrlenW (lpString=".ppt") returned 4
	[0090.929] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.929] lstrlenW (lpString=".zip") returned 4
	[0090.929] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.929] lstrlenW (lpString=".rar") returned 4
	[0090.929] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.929] lstrlenW (lpString=".bz2") returned 4
	[0090.930] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.930] lstrlenW (lpString=".7z") returned 3
	[0090.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.930] lstrlenW (lpString=".dbf") returned 4
	[0090.930] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.930] lstrlenW (lpString=".1cd") returned 4
	[0090.931] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0090.931] lstrlenW (lpString=".jpg") returned 4
	[0090.931] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.932] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.932] lstrlenW (lpString="base_jpn.xml") returned 12
	[0090.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.933] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=804) returned 1
	[0090.933] CloseHandle (hObject=0x1f4) returned 1
	[0090.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20
	[0090.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.934] lstrlenW (lpString=".doc") returned 4
	[0090.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.935] lstrlenW (lpString=".docx") returned 5
	[0090.935] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0090.935] lstrlenW (lpString=".pdf") returned 4
	[0090.935] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.935] lstrlenW (lpString=".xls") returned 4
	[0090.935] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.936] lstrlenW (lpString=".xlsx") returned 5
	[0090.936] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0090.936] lstrlenW (lpString=".ppt") returned 4
	[0090.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.936] lstrlenW (lpString=".zip") returned 4
	[0090.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.936] lstrlenW (lpString=".rar") returned 4
	[0090.937] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.937] lstrlenW (lpString=".bz2") returned 4
	[0090.937] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.937] lstrlenW (lpString=".7z") returned 3
	[0090.937] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.937] lstrlenW (lpString=".dbf") returned 4
	[0090.938] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.938] lstrlenW (lpString=".1cd") returned 4
	[0090.938] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.938] lstrlenW (lpString=".jpg") returned 4
	[0090.938] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.939] lstrlenW (lpString=".doc") returned 4
	[0090.939] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.939] lstrlenW (lpString=".docx") returned 5
	[0090.939] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0090.939] lstrlenW (lpString=".pdf") returned 4
	[0090.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.940] lstrlenW (lpString=".xls") returned 4
	[0090.940] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.940] lstrlenW (lpString=".xlsx") returned 5
	[0090.940] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0090.940] lstrlenW (lpString=".ppt") returned 4
	[0090.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.940] lstrlenW (lpString=".zip") returned 4
	[0090.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.941] lstrlenW (lpString=".rar") returned 4
	[0090.941] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.941] lstrlenW (lpString=".bz2") returned 4
	[0090.941] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.941] lstrlenW (lpString=".7z") returned 3
	[0090.941] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.941] lstrlenW (lpString=".dbf") returned 4
	[0090.941] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.942] lstrlenW (lpString=".1cd") returned 4
	[0090.942] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0090.942] lstrlenW (lpString=".jpg") returned 4
	[0090.942] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.943] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.943] lstrlenW (lpString="base_kor.xml") returned 12
	[0090.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.954] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=488) returned 1
	[0090.955] CloseHandle (hObject=0x1f4) returned 1
	[0090.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20
	[0090.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.956] lstrlenW (lpString=".doc") returned 4
	[0090.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.956] lstrlenW (lpString=".docx") returned 5
	[0090.956] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0090.956] lstrlenW (lpString=".pdf") returned 4
	[0090.957] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.957] lstrlenW (lpString=".xls") returned 4
	[0090.957] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.957] lstrlenW (lpString=".xlsx") returned 5
	[0090.957] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0090.957] lstrlenW (lpString=".ppt") returned 4
	[0090.957] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.957] lstrlenW (lpString=".zip") returned 4
	[0090.957] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.957] lstrlenW (lpString=".rar") returned 4
	[0090.958] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.958] lstrlenW (lpString=".bz2") returned 4
	[0090.958] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.958] lstrlenW (lpString=".7z") returned 3
	[0090.958] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.958] lstrlenW (lpString=".dbf") returned 4
	[0090.958] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.958] lstrlenW (lpString=".1cd") returned 4
	[0090.958] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.959] lstrlenW (lpString=".jpg") returned 4
	[0090.959] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.959] lstrlenW (lpString=".doc") returned 4
	[0090.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.959] lstrlenW (lpString=".docx") returned 5
	[0090.959] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0090.959] lstrlenW (lpString=".pdf") returned 4
	[0090.959] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.960] lstrlenW (lpString=".xls") returned 4
	[0090.960] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.960] lstrlenW (lpString=".xlsx") returned 5
	[0090.960] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0090.960] lstrlenW (lpString=".ppt") returned 4
	[0090.960] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.960] lstrlenW (lpString=".zip") returned 4
	[0090.960] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.960] lstrlenW (lpString=".rar") returned 4
	[0090.961] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.961] lstrlenW (lpString=".bz2") returned 4
	[0090.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.961] lstrlenW (lpString=".7z") returned 3
	[0090.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.961] lstrlenW (lpString=".dbf") returned 4
	[0090.961] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.961] lstrlenW (lpString=".1cd") returned 4
	[0090.962] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82
	[0090.962] lstrlenW (lpString=".jpg") returned 4
	[0090.962] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.963] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.963] lstrlenW (lpString="base_rtl.xml") returned 12
	[0090.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.963] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=617) returned 1
	[0090.963] CloseHandle (hObject=0x1f4) returned 1
	[0090.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20
	[0090.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.965] lstrlenW (lpString=".doc") returned 4
	[0090.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.965] lstrlenW (lpString=".docx") returned 5
	[0090.965] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0090.965] lstrlenW (lpString=".pdf") returned 4
	[0090.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.965] lstrlenW (lpString=".xls") returned 4
	[0090.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.965] lstrlenW (lpString=".xlsx") returned 5
	[0090.965] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0090.966] lstrlenW (lpString=".ppt") returned 4
	[0090.966] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.966] lstrlenW (lpString=".zip") returned 4
	[0090.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.966] lstrlenW (lpString=".rar") returned 4
	[0090.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.966] lstrlenW (lpString=".bz2") returned 4
	[0090.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.966] lstrlenW (lpString=".7z") returned 3
	[0090.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.967] lstrlenW (lpString=".dbf") returned 4
	[0090.967] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.967] lstrlenW (lpString=".1cd") returned 4
	[0090.967] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.967] lstrlenW (lpString=".jpg") returned 4
	[0090.967] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.968] lstrlenW (lpString=".doc") returned 4
	[0090.968] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.968] lstrlenW (lpString=".docx") returned 5
	[0090.969] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0090.969] lstrlenW (lpString=".pdf") returned 4
	[0090.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.969] lstrlenW (lpString=".xls") returned 4
	[0090.969] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.969] lstrlenW (lpString=".xlsx") returned 5
	[0090.969] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0090.969] lstrlenW (lpString=".ppt") returned 4
	[0090.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.973] lstrlenW (lpString=".zip") returned 4
	[0090.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.973] lstrlenW (lpString=".rar") returned 4
	[0090.974] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.974] lstrlenW (lpString=".bz2") returned 4
	[0090.974] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.974] lstrlenW (lpString=".7z") returned 3
	[0090.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.974] lstrlenW (lpString=".dbf") returned 4
	[0090.974] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0090.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.974] lstrlenW (lpString=".1cd") returned 4
	[0090.975] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0090.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82
	[0090.975] lstrlenW (lpString=".jpg") returned 4
	[0090.975] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0090.976] lstrcmpiW (lpString1=".xml", lpString2=".lina") returned 1
	[0090.976] lstrlenW (lpString="ja-jp.xml") returned 9
	[0090.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0090.985] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16616) returned 1
	[0090.989] CloseHandle (hObject=0x1f4) returned 1
	[0090.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20
	[0090.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0090.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79
	[0090.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79
	[0090.991] lstrlenW (lpString=".doc") returned 4
	[0090.991] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0090.991] lstrlenW (lpString=".docx") returned 5
	[0090.991] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0090.991] lstrlenW (lpString=".pdf") returned 4
	[0090.991] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0090.991] lstrlenW (lpString=".xls") returned 4
	[0090.992] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0090.992] lstrlenW (lpString=".xlsx") returned 5
	[0090.992] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0090.992] lstrlenW (lpString=".ppt") returned 4
	[0090.992] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0090.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79
	[0090.992] lstrlenW (lpString=".zip") returned 4
	[0090.992] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0090.993] lstrlenW (lpString=".rar") returned 4
	[0090.993] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0090.993] lstrlenW (lpString=".bz2") returned 4
	[0090.993] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0090.993] lstrlenW (lpString=".7z") returned 3
	[0090.993] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0090.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79
	[0090.993] lstrlenW (lpString=".dbf") returned 4
	[0090.993] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0093.356] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.356] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0093.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0093.357] GetLastError () returned 0x0
	[0093.358] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x795, lpOverlapped=0x0) returned 1
	[0094.443] WriteFile (in: hFile=0x1ec, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7a0, lpOverlapped=0x0) returned 1
	[0094.445] ReadFile (in: hFile=0x1d8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.445] WriteFile (in: hFile=0x1ec, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0094.445] SetEndOfFile (hFile=0x1ec) returned 1
	[0094.446] CloseHandle (hObject=0x1ec) returned 1
	[0094.447] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.448] SetEndOfFile (hFile=0x1d8) returned 1
	[0094.449] CloseHandle (hObject=0x1d8) returned 1
	[0094.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0094.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1
	[0094.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.452] lstrlenW (lpString=".doc") returned 4
	[0094.452] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0094.452] lstrlenW (lpString=".docx") returned 5
	[0094.452] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0094.453] lstrlenW (lpString=".pdf") returned 4
	[0094.453] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0094.453] lstrlenW (lpString=".xls") returned 4
	[0094.453] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0094.453] lstrlenW (lpString=".xlsx") returned 5
	[0094.454] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0094.454] lstrlenW (lpString=".ppt") returned 4
	[0094.454] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0094.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.454] lstrlenW (lpString=".zip") returned 4
	[0094.455] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0094.455] lstrlenW (lpString=".rar") returned 4
	[0094.455] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0094.455] lstrlenW (lpString=".bz2") returned 4
	[0094.455] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0094.455] lstrlenW (lpString=".7z") returned 3
	[0094.455] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0094.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.456] lstrlenW (lpString=".dbf") returned 4
	[0094.456] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0094.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.456] lstrlenW (lpString=".1cd") returned 4
	[0094.456] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0094.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.457] lstrlenW (lpString=".jpg") returned 4
	[0094.457] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0094.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.458] lstrlenW (lpString=".doc") returned 4
	[0094.458] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0094.458] lstrlenW (lpString=".docx") returned 5
	[0094.458] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0094.458] lstrlenW (lpString=".pdf") returned 4
	[0094.459] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0094.459] lstrlenW (lpString=".xls") returned 4
	[0094.459] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0094.459] lstrlenW (lpString=".xlsx") returned 5
	[0094.460] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0094.460] lstrlenW (lpString=".ppt") returned 4
	[0094.460] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0094.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.460] lstrlenW (lpString=".zip") returned 4
	[0094.461] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0094.461] lstrlenW (lpString=".rar") returned 4
	[0094.461] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0094.461] lstrlenW (lpString=".bz2") returned 4
	[0094.461] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0094.461] lstrlenW (lpString=".7z") returned 3
	[0094.462] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0094.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.462] lstrlenW (lpString=".dbf") returned 4
	[0094.462] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0094.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.463] lstrlenW (lpString=".1cd") returned 4
	[0094.463] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0094.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0094.463] lstrlenW (lpString=".jpg") returned 4
	[0094.463] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0094.464] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0094.465] lstrlenW (lpString="SETUP.XML") returned 9
	[0094.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0094.537] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2624) returned 1
	[0094.537] CloseHandle (hObject=0x210) returned 1
	[0094.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20
	[0094.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0094.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0094.538] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.539] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4
	[0094.540] GetLastError () returned 0x0
	[0094.540] ReadFile (in: hFile=0x210, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0xa40, lpOverlapped=0x0) returned 1
	[0094.543] WriteFile (in: hFile=0x1d4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0094.544] ReadFile (in: hFile=0x210, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0094.544] WriteFile (in: hFile=0x1d4, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0094.545] SetEndOfFile (hFile=0x1d4) returned 1
	[0094.545] CloseHandle (hObject=0x1d4) returned 1
	[0094.546] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.547] SetEndOfFile (hFile=0x210) returned 1
	[0094.548] CloseHandle (hObject=0x210) returned 1
	[0094.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0094.549] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1
	[0094.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.550] lstrlenW (lpString=".doc") returned 4
	[0094.550] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.550] lstrlenW (lpString=".docx") returned 5
	[0094.551] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0094.551] lstrlenW (lpString=".pdf") returned 4
	[0094.551] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.551] lstrlenW (lpString=".xls") returned 4
	[0094.551] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.551] lstrlenW (lpString=".xlsx") returned 5
	[0094.551] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0094.552] lstrlenW (lpString=".ppt") returned 4
	[0094.552] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.779] lstrlenW (lpString=".zip") returned 4
	[0094.780] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.780] lstrlenW (lpString=".rar") returned 4
	[0094.780] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.780] lstrlenW (lpString=".bz2") returned 4
	[0094.780] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.780] lstrlenW (lpString=".7z") returned 3
	[0094.781] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.781] lstrlenW (lpString=".dbf") returned 4
	[0094.781] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.781] lstrlenW (lpString=".1cd") returned 4
	[0094.782] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.782] lstrlenW (lpString=".jpg") returned 4
	[0094.782] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.783] lstrlenW (lpString=".doc") returned 4
	[0094.783] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0094.783] lstrlenW (lpString=".docx") returned 5
	[0094.783] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0094.784] lstrlenW (lpString=".pdf") returned 4
	[0094.784] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0094.784] lstrlenW (lpString=".xls") returned 4
	[0094.784] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0094.784] lstrlenW (lpString=".xlsx") returned 5
	[0094.785] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0094.785] lstrlenW (lpString=".ppt") returned 4
	[0094.785] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0094.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.785] lstrlenW (lpString=".zip") returned 4
	[0094.785] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0094.786] lstrlenW (lpString=".rar") returned 4
	[0094.786] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0094.786] lstrlenW (lpString=".bz2") returned 4
	[0094.786] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0094.786] lstrlenW (lpString=".7z") returned 3
	[0094.786] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0094.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.787] lstrlenW (lpString=".dbf") returned 4
	[0094.787] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0094.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.787] lstrlenW (lpString=".1cd") returned 4
	[0094.787] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0094.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0094.788] lstrlenW (lpString=".jpg") returned 4
	[0094.788] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0094.789] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0094.789] lstrlenW (lpString="SETUP.XML") returned 9
	[0094.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0096.137] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1452) returned 1
	[0096.138] CloseHandle (hObject=0x1ec) returned 1
	[0096.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20
	[0096.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0096.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0096.139] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.139] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0096.140] GetLastError () returned 0x0
	[0096.140] ReadFile (in: hFile=0x1ec, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0096.448] WriteFile (in: hFile=0x20c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0096.452] ReadFile (in: hFile=0x1ec, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.452] WriteFile (in: hFile=0x20c, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0096.452] SetEndOfFile (hFile=0x20c) returned 1
	[0096.453] CloseHandle (hObject=0x20c) returned 1
	[0096.457] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.458] SetEndOfFile (hFile=0x1ec) returned 1
	[0096.459] CloseHandle (hObject=0x1ec) returned 1
	[0096.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0096.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1
	[0096.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.461] lstrlenW (lpString=".doc") returned 4
	[0096.461] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.461] lstrlenW (lpString=".docx") returned 5
	[0096.461] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0096.462] lstrlenW (lpString=".pdf") returned 4
	[0096.462] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.462] lstrlenW (lpString=".xls") returned 4
	[0096.462] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.462] lstrlenW (lpString=".xlsx") returned 5
	[0096.462] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0096.462] lstrlenW (lpString=".ppt") returned 4
	[0096.463] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.463] lstrlenW (lpString=".zip") returned 4
	[0096.463] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.463] lstrlenW (lpString=".rar") returned 4
	[0096.463] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.464] lstrlenW (lpString=".bz2") returned 4
	[0096.464] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.464] lstrlenW (lpString=".7z") returned 3
	[0096.464] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.464] lstrlenW (lpString=".dbf") returned 4
	[0096.464] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.465] lstrlenW (lpString=".1cd") returned 4
	[0096.465] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.465] lstrlenW (lpString=".jpg") returned 4
	[0096.465] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.466] lstrlenW (lpString=".doc") returned 4
	[0096.466] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0096.466] lstrlenW (lpString=".docx") returned 5
	[0096.467] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0096.467] lstrlenW (lpString=".pdf") returned 4
	[0096.467] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0096.467] lstrlenW (lpString=".xls") returned 4
	[0096.467] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0096.467] lstrlenW (lpString=".xlsx") returned 5
	[0096.468] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0096.468] lstrlenW (lpString=".ppt") returned 4
	[0096.468] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0096.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.468] lstrlenW (lpString=".zip") returned 4
	[0096.468] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0096.469] lstrlenW (lpString=".rar") returned 4
	[0096.469] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0096.469] lstrlenW (lpString=".bz2") returned 4
	[0096.469] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0096.469] lstrlenW (lpString=".7z") returned 3
	[0096.469] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0096.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.470] lstrlenW (lpString=".dbf") returned 4
	[0096.470] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0096.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.470] lstrlenW (lpString=".1cd") returned 4
	[0096.470] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0096.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0096.471] lstrlenW (lpString=".jpg") returned 4
	[0096.471] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0096.472] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0096.472] lstrlenW (lpString="OfficeMUI.XML") returned 13
	[0096.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0096.529] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5557) returned 1
	[0096.562] CloseHandle (hObject=0x200) returned 1
	[0096.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20
	[0096.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0096.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0096.564] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.565] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0096.566] GetLastError () returned 0x0
	[0096.566] ReadFile (in: hFile=0x200, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0096.571] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0096.573] ReadFile (in: hFile=0x200, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0096.573] WriteFile (in: hFile=0x1e8, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0096.574] SetEndOfFile (hFile=0x1e8) returned 1
	[0096.574] CloseHandle (hObject=0x1e8) returned 1
	[0096.576] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.577] SetEndOfFile (hFile=0x200) returned 1
	[0096.579] CloseHandle (hObject=0x200) returned 1
	[0096.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0096.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1
	[0097.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.829] lstrlenW (lpString=".doc") returned 4
	[0097.829] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0097.829] lstrlenW (lpString=".docx") returned 5
	[0097.830] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0097.830] lstrlenW (lpString=".pdf") returned 4
	[0097.830] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0097.830] lstrlenW (lpString=".xls") returned 4
	[0097.830] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0097.830] lstrlenW (lpString=".xlsx") returned 5
	[0097.830] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0097.830] lstrlenW (lpString=".ppt") returned 4
	[0097.831] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0097.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.831] lstrlenW (lpString=".zip") returned 4
	[0097.831] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0097.831] lstrlenW (lpString=".rar") returned 4
	[0097.831] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0097.832] lstrlenW (lpString=".bz2") returned 4
	[0097.832] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0097.832] lstrlenW (lpString=".7z") returned 3
	[0097.832] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0097.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.832] lstrlenW (lpString=".dbf") returned 4
	[0097.832] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0097.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.833] lstrlenW (lpString=".1cd") returned 4
	[0097.833] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0097.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.833] lstrlenW (lpString=".jpg") returned 4
	[0097.833] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0097.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.834] lstrlenW (lpString=".doc") returned 4
	[0097.834] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0097.834] lstrlenW (lpString=".docx") returned 5
	[0097.835] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0097.835] lstrlenW (lpString=".pdf") returned 4
	[0097.835] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0097.835] lstrlenW (lpString=".xls") returned 4
	[0097.835] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0097.835] lstrlenW (lpString=".xlsx") returned 5
	[0097.835] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0097.836] lstrlenW (lpString=".ppt") returned 4
	[0097.836] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0097.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.836] lstrlenW (lpString=".zip") returned 4
	[0097.836] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0097.836] lstrlenW (lpString=".rar") returned 4
	[0097.836] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0097.837] lstrlenW (lpString=".bz2") returned 4
	[0097.837] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0097.837] lstrlenW (lpString=".7z") returned 3
	[0097.837] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0097.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.837] lstrlenW (lpString=".dbf") returned 4
	[0097.837] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0097.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.838] lstrlenW (lpString=".1cd") returned 4
	[0097.838] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0097.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0097.838] lstrlenW (lpString=".jpg") returned 4
	[0097.838] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0097.839] lstrcmpiW (lpString1=".CHM", lpString2=".lina") returned -1
	[0097.839] lstrlenW (lpString="PSS10R.CHM") returned 10
	[0097.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0099.430] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=27195) returned 1
	[0099.430] CloseHandle (hObject=0x1f4) returned 1
	[0099.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20
	[0099.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0099.431] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.431] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0099.432] GetLastError () returned 0x0
	[0099.432] ReadFile (in: hFile=0x1f4, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0099.513] WriteFile (in: hFile=0x1e0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0099.517] ReadFile (in: hFile=0x1f4, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.517] WriteFile (in: hFile=0x1e0, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0099.518] SetEndOfFile (hFile=0x1e0) returned 1
	[0099.518] CloseHandle (hObject=0x1e0) returned 1
	[0099.518] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.519] SetEndOfFile (hFile=0x1f4) returned 1
	[0099.521] CloseHandle (hObject=0x1f4) returned 1
	[0099.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0099.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1
	[0099.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.523] lstrlenW (lpString=".doc") returned 4
	[0099.523] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.523] lstrlenW (lpString=".docx") returned 5
	[0099.523] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0099.523] lstrlenW (lpString=".pdf") returned 4
	[0099.523] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.523] lstrlenW (lpString=".xls") returned 4
	[0099.524] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.524] lstrlenW (lpString=".xlsx") returned 5
	[0099.524] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0099.524] lstrlenW (lpString=".ppt") returned 4
	[0099.524] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.524] lstrlenW (lpString=".zip") returned 4
	[0099.524] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.525] lstrlenW (lpString=".rar") returned 4
	[0099.525] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.525] lstrlenW (lpString=".bz2") returned 4
	[0099.525] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.525] lstrlenW (lpString=".7z") returned 3
	[0099.525] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.526] lstrlenW (lpString=".dbf") returned 4
	[0099.526] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.526] lstrlenW (lpString=".1cd") returned 4
	[0099.526] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.526] lstrlenW (lpString=".jpg") returned 4
	[0099.527] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.527] lstrlenW (lpString=".doc") returned 4
	[0099.527] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0099.528] lstrlenW (lpString=".docx") returned 5
	[0099.528] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0099.528] lstrlenW (lpString=".pdf") returned 4
	[0099.528] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0099.528] lstrlenW (lpString=".xls") returned 4
	[0099.528] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0099.528] lstrlenW (lpString=".xlsx") returned 5
	[0099.529] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0099.529] lstrlenW (lpString=".ppt") returned 4
	[0099.529] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0099.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.529] lstrlenW (lpString=".zip") returned 4
	[0099.529] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0099.529] lstrlenW (lpString=".rar") returned 4
	[0099.530] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0099.530] lstrlenW (lpString=".bz2") returned 4
	[0099.530] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0099.530] lstrlenW (lpString=".7z") returned 3
	[0099.530] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0099.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.531] lstrlenW (lpString=".dbf") returned 4
	[0099.531] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0099.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.531] lstrlenW (lpString=".1cd") returned 4
	[0099.531] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0099.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0099.531] lstrlenW (lpString=".jpg") returned 4
	[0099.532] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0099.533] lstrcmpiW (lpString1=".XML", lpString2=".lina") returned 1
	[0099.533] lstrlenW (lpString="Office32MUI.XML") returned 15
	[0099.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0099.562] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1383) returned 1
	[0099.562] CloseHandle (hObject=0x1c8) returned 1
	[0099.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20
	[0099.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0099.563] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.563] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0099.585] GetLastError () returned 0x0
	[0099.585] ReadFile (in: hFile=0x1c8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x567, lpOverlapped=0x0) returned 1
	[0099.593] WriteFile (in: hFile=0x1cc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0099.595] ReadFile (in: hFile=0x1c8, lpBuffer=0x36c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0099.595] WriteFile (in: hFile=0x1cc, lpBuffer=0x36c0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36c0020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0099.596] SetEndOfFile (hFile=0x1cc) returned 1
	[0099.596] CloseHandle (hObject=0x1cc) returned 1
	[0099.596] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.597] SetEndOfFile (hFile=0x1c8) returned 1
	[0099.598] CloseHandle (hObject=0x1c8) returned 1
	[0099.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x20) returned 1
	[0099.599] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1
	[0099.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.600] lstrlenW (lpString=".doc") returned 4
	[0099.600] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.600] lstrlenW (lpString=".docx") returned 5
	[0099.600] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0099.601] lstrlenW (lpString=".pdf") returned 4
	[0099.601] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.601] lstrlenW (lpString=".xls") returned 4
	[0099.601] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.601] lstrlenW (lpString=".xlsx") returned 5
	[0099.601] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0099.601] lstrlenW (lpString=".ppt") returned 4
	[0099.601] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0099.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.602] lstrlenW (lpString=".zip") returned 4
	[0099.602] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0099.602] lstrlenW (lpString=".rar") returned 4
	[0099.602] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0099.602] lstrlenW (lpString=".bz2") returned 4
	[0099.602] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0099.603] lstrlenW (lpString=".7z") returned 3
	[0099.603] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0099.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.603] lstrlenW (lpString=".dbf") returned 4
	[0099.603] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0099.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.603] lstrlenW (lpString=".1cd") returned 4
	[0099.604] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0099.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.604] lstrlenW (lpString=".jpg") returned 4
	[0099.604] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0099.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0099.605] lstrlenW (lpString=".doc") returned 4
	[0099.605] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0099.605] lstrlenW (lpString=".docx") returned 5
	[0099.605] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0099.605] lstrlenW (lpString=".pdf") returned 4
	[0099.605] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0099.605] lstrlenW (lpString=".xls") returned 4
	[0099.605] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0099.606] lstrlenW (lpString=".xlsx") returned 5
	[0099.606] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0099.606] lstrlenW (lpString=".ppt") returned 4
	[0099.606] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1

Thread:
	id = 14
	os_tid = 0x7d4

	[0072.536] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x35e0058
	[0072.539] lstrlenW (lpString="C:") returned 2
	[0072.539] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2ecfd00 | out: lpFindFileData=0x2ecfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x3315f8
	[0072.540] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0072.540] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0072.540] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0072.541] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0072.541] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x35f0060
	[0072.542] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0072.542] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331638
	[0072.543] FindNextFileW (in: hFindFile=0x331638, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.543] FindNextFileW (in: hFindFile=0x331638, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0072.544] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0072.544] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0072.544] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0072.544] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0072.544] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3601070
	[0072.545] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0072.545] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331678
	[0072.546] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.546] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0072.546] lstrlenW (lpString="desktop.ini") returned 11
	[0072.546] lstrlenW (lpString=".1cd") returned 4
	[0072.547] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0072.547] lstrlenW (lpString=".3ds") returned 4
	[0072.547] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0072.547] lstrlenW (lpString=".3fr") returned 4
	[0072.547] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0072.547] lstrlenW (lpString=".3g2") returned 4
	[0072.547] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0072.547] lstrlenW (lpString=".3gp") returned 4
	[0072.548] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0072.548] lstrlenW (lpString=".7z") returned 3
	[0072.548] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0072.548] lstrlenW (lpString=".accda") returned 6
	[0072.548] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0072.548] lstrlenW (lpString=".accdb") returned 6
	[0072.548] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0072.549] lstrlenW (lpString=".accdc") returned 6
	[0072.549] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0072.549] lstrlenW (lpString=".accde") returned 6
	[0072.549] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0072.549] lstrlenW (lpString=".accdt") returned 6
	[0072.549] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0072.549] lstrlenW (lpString=".accdw") returned 6
	[0072.550] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0072.550] lstrlenW (lpString=".adb") returned 4
	[0072.550] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0072.550] lstrlenW (lpString=".adp") returned 4
	[0072.550] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0072.550] lstrlenW (lpString=".ai") returned 3
	[0072.551] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0072.551] lstrlenW (lpString=".ai3") returned 4
	[0072.551] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0072.551] lstrlenW (lpString=".ai4") returned 4
	[0072.551] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0072.552] lstrlenW (lpString=".ai5") returned 4
	[0072.552] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0072.552] lstrlenW (lpString=".ai6") returned 4
	[0072.552] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0072.552] lstrlenW (lpString=".ai7") returned 4
	[0072.552] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0072.553] lstrlenW (lpString=".ai8") returned 4
	[0072.553] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0072.553] lstrlenW (lpString=".anim") returned 5
	[0072.553] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0072.553] lstrlenW (lpString=".arw") returned 4
	[0072.553] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0072.554] lstrlenW (lpString=".as") returned 3
	[0072.554] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0072.554] lstrlenW (lpString=".asa") returned 4
	[0072.554] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0072.554] lstrlenW (lpString=".asc") returned 4
	[0072.554] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0072.555] lstrlenW (lpString=".ascx") returned 5
	[0072.555] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0072.555] lstrlenW (lpString=".asm") returned 4
	[0072.555] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0072.555] lstrlenW (lpString=".asmx") returned 5
	[0072.555] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0072.556] lstrlenW (lpString=".asp") returned 4
	[0072.556] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0072.556] lstrlenW (lpString=".aspx") returned 5
	[0072.556] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0072.556] lstrlenW (lpString=".asr") returned 4
	[0072.556] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0072.556] lstrlenW (lpString=".asx") returned 4
	[0072.557] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0072.557] lstrlenW (lpString=".avi") returned 4
	[0072.557] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0072.557] lstrlenW (lpString=".avs") returned 4
	[0072.557] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0072.558] lstrlenW (lpString=".backup") returned 7
	[0072.558] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0072.558] lstrlenW (lpString=".bak") returned 4
	[0072.558] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0072.558] lstrlenW (lpString=".bay") returned 4
	[0072.559] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0072.559] lstrlenW (lpString=".bd") returned 3
	[0072.559] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0072.559] lstrlenW (lpString=".bin") returned 4
	[0072.559] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0072.559] lstrlenW (lpString=".bmp") returned 4
	[0072.560] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0072.560] lstrlenW (lpString=".bz2") returned 4
	[0072.560] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0072.560] lstrlenW (lpString=".c") returned 2
	[0072.560] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0072.561] lstrlenW (lpString=".cdr") returned 4
	[0072.561] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0072.561] lstrlenW (lpString=".cer") returned 4
	[0072.561] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0072.561] lstrlenW (lpString=".cf") returned 3
	[0072.561] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0072.562] lstrlenW (lpString=".cfc") returned 4
	[0072.562] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0072.562] lstrlenW (lpString=".cfm") returned 4
	[0072.562] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0072.562] lstrlenW (lpString=".cfml") returned 5
	[0072.562] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0072.563] lstrlenW (lpString=".cfu") returned 4
	[0072.563] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0072.563] lstrlenW (lpString=".chm") returned 4
	[0072.563] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0072.563] lstrlenW (lpString=".cin") returned 4
	[0072.564] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0072.564] lstrlenW (lpString=".class") returned 6
	[0072.564] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0072.564] lstrlenW (lpString=".clx") returned 4
	[0072.564] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0072.564] lstrlenW (lpString=".config") returned 7
	[0072.565] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0072.565] lstrlenW (lpString=".cpp") returned 4
	[0072.565] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0072.565] lstrlenW (lpString=".cr2") returned 4
	[0072.565] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0072.565] lstrlenW (lpString=".crt") returned 4
	[0072.566] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0072.566] lstrlenW (lpString=".crw") returned 4
	[0072.566] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0072.566] lstrlenW (lpString=".cs") returned 3
	[0072.566] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0072.566] lstrlenW (lpString=".css") returned 4
	[0072.567] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0072.567] lstrlenW (lpString=".csv") returned 4
	[0072.567] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0072.567] lstrlenW (lpString=".cub") returned 4
	[0072.567] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0072.567] lstrlenW (lpString=".dae") returned 4
	[0072.568] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0072.568] lstrlenW (lpString=".dat") returned 4
	[0072.568] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0072.568] lstrlenW (lpString=".db") returned 3
	[0072.568] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0072.568] lstrlenW (lpString=".dbf") returned 4
	[0072.569] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0072.569] lstrlenW (lpString=".dbx") returned 4
	[0072.569] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0072.569] lstrlenW (lpString=".dc3") returned 4
	[0072.569] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0072.569] lstrlenW (lpString=".dcm") returned 4
	[0072.570] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0072.570] lstrlenW (lpString=".dcr") returned 4
	[0072.570] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0072.570] lstrlenW (lpString=".der") returned 4
	[0072.570] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0072.570] lstrlenW (lpString=".dib") returned 4
	[0072.571] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0072.571] lstrlenW (lpString=".dic") returned 4
	[0072.571] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0072.571] lstrlenW (lpString=".dif") returned 4
	[0072.571] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0072.653] lstrlenW (lpString=".divx") returned 5
	[0072.653] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0072.653] lstrlenW (lpString=".djvu") returned 5
	[0072.653] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0072.653] lstrlenW (lpString=".dng") returned 4
	[0072.653] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0072.653] lstrlenW (lpString=".doc") returned 4
	[0072.654] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0072.654] lstrlenW (lpString=".docm") returned 5
	[0072.654] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0072.654] lstrlenW (lpString=".docx") returned 5
	[0072.654] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0072.654] lstrlenW (lpString=".dot") returned 4
	[0072.654] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0072.655] lstrlenW (lpString=".dotm") returned 5
	[0072.655] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0072.655] lstrlenW (lpString=".dotx") returned 5
	[0072.655] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0072.655] lstrlenW (lpString=".dpx") returned 4
	[0072.655] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0072.655] lstrlenW (lpString=".dqy") returned 4
	[0072.656] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0072.656] lstrlenW (lpString=".dsn") returned 4
	[0072.656] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0072.656] lstrlenW (lpString=".dt") returned 3
	[0072.656] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0072.656] lstrlenW (lpString=".dtd") returned 4
	[0072.656] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0072.657] lstrlenW (lpString=".dwg") returned 4
	[0072.657] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0072.657] lstrlenW (lpString=".dwt") returned 4
	[0072.657] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0072.657] lstrlenW (lpString=".dx") returned 3
	[0072.657] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0072.657] lstrlenW (lpString=".dxf") returned 4
	[0072.657] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0072.658] lstrlenW (lpString=".edml") returned 5
	[0072.658] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0072.658] lstrlenW (lpString=".efd") returned 4
	[0072.658] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0072.658] lstrlenW (lpString=".elf") returned 4
	[0072.658] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0072.658] lstrlenW (lpString=".emf") returned 4
	[0072.658] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0072.659] lstrlenW (lpString=".emz") returned 4
	[0072.659] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0072.659] lstrlenW (lpString=".epf") returned 4
	[0072.659] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0072.659] lstrlenW (lpString=".eps") returned 4
	[0072.659] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0072.659] lstrlenW (lpString=".epsf") returned 5
	[0072.660] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0072.660] lstrlenW (lpString=".epsp") returned 5
	[0072.660] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0072.660] lstrlenW (lpString=".erf") returned 4
	[0072.660] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0072.660] lstrlenW (lpString=".exr") returned 4
	[0072.660] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0072.661] lstrlenW (lpString=".f4v") returned 4
	[0072.661] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0072.661] lstrlenW (lpString=".fido") returned 5
	[0072.661] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0072.661] lstrlenW (lpString=".flm") returned 4
	[0072.661] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0072.661] lstrlenW (lpString=".flv") returned 4
	[0072.661] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0072.662] lstrlenW (lpString=".frm") returned 4
	[0072.662] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0072.662] lstrlenW (lpString=".fxg") returned 4
	[0072.662] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0072.662] lstrlenW (lpString=".geo") returned 4
	[0072.662] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0072.662] lstrlenW (lpString=".gif") returned 4
	[0072.663] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0072.663] lstrlenW (lpString=".grs") returned 4
	[0072.663] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0072.663] lstrlenW (lpString=".gz") returned 3
	[0072.663] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0072.663] lstrlenW (lpString=".h") returned 2
	[0072.663] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0072.663] lstrlenW (lpString=".hdr") returned 4
	[0072.664] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0072.664] lstrlenW (lpString=".hpp") returned 4
	[0072.664] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0072.664] lstrlenW (lpString=".hta") returned 4
	[0072.664] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0072.664] lstrlenW (lpString=".htc") returned 4
	[0072.664] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0072.664] lstrlenW (lpString=".htm") returned 4
	[0072.665] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0072.665] lstrlenW (lpString=".html") returned 5
	[0072.665] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0072.665] lstrlenW (lpString=".icb") returned 4
	[0072.665] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0072.665] lstrlenW (lpString=".ics") returned 4
	[0072.666] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0072.666] lstrlenW (lpString=".iff") returned 4
	[0072.666] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0072.666] lstrlenW (lpString=".inc") returned 4
	[0072.666] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0072.666] lstrlenW (lpString=".indd") returned 5
	[0072.666] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0072.667] lstrlenW (lpString=".ini") returned 4
	[0072.667] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0072.667] lstrlenW (lpString="desktop.ini") returned 11
	[0072.667] lstrlenW (lpString=".lina") returned 5
	[0072.667] lstrcmpiW (lpString1=".lina", lpString2="p.ini") returned -1
	[0072.667] lstrlenW (lpString="desktop.ini") returned 11
	[0072.667] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1
	[0072.667] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1
	[0072.668] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1
	[0072.668] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1
	[0072.668] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1
	[0072.668] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1
	[0072.668] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1
	[0072.668] lstrcmpiW (lpString1="000005.exe", lpString2="desktop.ini") returned -1
	[0072.668] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0072.669] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0072.669] FindClose (in: hFindFile=0x331678 | out: hFindFile=0x331678) returned 1
	[0072.669] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3601070 | out: hHeap=0x2e0000) returned 1
	[0072.670] FindNextFileW (in: hFindFile=0x331638, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0072.670] FindClose (in: hFindFile=0x331638 | out: hFindFile=0x331638) returned 1
	[0072.670] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35f0060 | out: hHeap=0x2e0000) returned 1
	[0072.670] FindNextFileW (in: hFindFile=0x3315f8, lpFindFileData=0x2ecfd00 | out: lpFindFileData=0x2ecfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0072.671] lstrlenW (lpString="C:\\Boot") returned 7
	[0072.671] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0072.671] lstrlenW (lpString="Boot") returned 4
	[0072.671] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0072.671] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x35f0060
	[0072.671] lstrlenW (lpString="C:\\Boot") returned 7
	[0072.671] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33a978
	[0072.672] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.672] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0072.672] lstrlenW (lpString="BCD") returned 3
	[0072.672] lstrlenW (lpString=".1cd") returned 4
	[0072.672] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0072.673] lstrlenW (lpString=".3ds") returned 4
	[0072.673] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0072.673] lstrlenW (lpString=".3fr") returned 4
	[0072.673] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0072.673] lstrlenW (lpString=".3g2") returned 4
	[0072.673] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0072.673] lstrlenW (lpString=".3gp") returned 4
	[0072.673] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0072.674] lstrlenW (lpString=".7z") returned 3
	[0072.674] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0072.674] lstrlenW (lpString=".accda") returned 6
	[0072.674] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0072.674] lstrlenW (lpString=".accdb") returned 6
	[0072.674] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0072.674] lstrlenW (lpString=".accdc") returned 6
	[0072.674] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0072.675] lstrlenW (lpString=".accde") returned 6
	[0072.675] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0072.675] lstrlenW (lpString=".accdt") returned 6
	[0072.675] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0072.675] lstrlenW (lpString=".accdw") returned 6
	[0072.675] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0072.675] lstrlenW (lpString=".adb") returned 4
	[0072.676] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0072.676] lstrlenW (lpString=".adp") returned 4
	[0072.676] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0072.676] lstrlenW (lpString=".ai") returned 3
	[0072.676] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0072.676] lstrlenW (lpString=".ai3") returned 4
	[0072.676] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0072.676] lstrlenW (lpString=".ai4") returned 4
	[0072.677] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0072.677] lstrlenW (lpString=".ai5") returned 4
	[0072.677] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0072.677] lstrlenW (lpString=".ai6") returned 4
	[0072.677] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0072.677] lstrlenW (lpString=".ai7") returned 4
	[0072.678] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0072.678] lstrlenW (lpString=".ai8") returned 4
	[0072.678] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0072.678] lstrlenW (lpString=".anim") returned 5
	[0072.678] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0072.678] lstrlenW (lpString=".arw") returned 4
	[0072.678] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0072.679] lstrlenW (lpString=".as") returned 3
	[0072.679] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0072.679] lstrlenW (lpString=".asa") returned 4
	[0072.679] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0072.679] lstrlenW (lpString=".asc") returned 4
	[0072.679] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0072.679] lstrlenW (lpString=".ascx") returned 5
	[0072.680] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0072.680] lstrlenW (lpString=".asm") returned 4
	[0072.680] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0072.680] lstrlenW (lpString=".asmx") returned 5
	[0072.680] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0072.680] lstrlenW (lpString=".asp") returned 4
	[0072.680] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0072.681] lstrlenW (lpString=".aspx") returned 5
	[0072.681] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0072.681] lstrlenW (lpString=".asr") returned 4
	[0072.682] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0072.682] lstrlenW (lpString=".asx") returned 4
	[0072.682] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0072.682] lstrlenW (lpString=".avi") returned 4
	[0072.682] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0072.682] lstrlenW (lpString=".avs") returned 4
	[0072.682] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0072.683] lstrlenW (lpString=".backup") returned 7
	[0072.683] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0072.683] lstrlenW (lpString=".bak") returned 4
	[0072.683] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0072.683] lstrlenW (lpString=".bay") returned 4
	[0072.683] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0072.684] lstrlenW (lpString=".bd") returned 3
	[0072.684] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0072.684] lstrlenW (lpString=".bin") returned 4
	[0072.684] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0072.684] lstrlenW (lpString=".bmp") returned 4
	[0072.684] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0072.684] lstrlenW (lpString=".bz2") returned 4
	[0072.685] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0072.685] lstrlenW (lpString=".c") returned 2
	[0072.685] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0072.685] lstrlenW (lpString=".cdr") returned 4
	[0072.685] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0072.685] lstrlenW (lpString=".cer") returned 4
	[0072.685] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0072.686] lstrlenW (lpString=".cf") returned 3
	[0072.686] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0072.686] lstrlenW (lpString=".cfc") returned 4
	[0072.686] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0072.686] lstrlenW (lpString=".cfm") returned 4
	[0072.686] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0072.686] lstrlenW (lpString=".cfml") returned 5
	[0072.687] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0072.687] lstrlenW (lpString=".cfu") returned 4
	[0072.687] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0072.687] lstrlenW (lpString=".chm") returned 4
	[0072.687] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0072.687] lstrlenW (lpString=".cin") returned 4
	[0072.687] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0072.687] lstrlenW (lpString=".class") returned 6
	[0072.688] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0072.688] lstrlenW (lpString=".clx") returned 4
	[0072.688] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0072.688] lstrlenW (lpString=".config") returned 7
	[0072.688] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0072.688] lstrlenW (lpString=".cpp") returned 4
	[0072.688] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0072.689] lstrlenW (lpString=".cr2") returned 4
	[0072.689] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0072.689] lstrlenW (lpString=".crt") returned 4
	[0072.689] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0072.689] lstrlenW (lpString=".crw") returned 4
	[0072.689] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0072.689] lstrlenW (lpString=".cs") returned 3
	[0072.689] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0072.690] lstrlenW (lpString=".css") returned 4
	[0072.690] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0072.690] lstrlenW (lpString=".csv") returned 4
	[0072.690] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0072.690] lstrlenW (lpString=".cub") returned 4
	[0072.690] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0072.690] lstrlenW (lpString=".dae") returned 4
	[0072.691] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0072.691] lstrlenW (lpString=".dat") returned 4
	[0072.691] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0072.691] lstrlenW (lpString=".db") returned 3
	[0072.691] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0072.691] lstrlenW (lpString=".dbf") returned 4
	[0072.692] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0072.692] lstrlenW (lpString=".dbx") returned 4
	[0072.692] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0072.692] lstrlenW (lpString=".dc3") returned 4
	[0072.692] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0072.692] lstrlenW (lpString=".dcm") returned 4
	[0072.692] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0072.693] lstrlenW (lpString=".dcr") returned 4
	[0072.693] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0072.693] lstrlenW (lpString=".der") returned 4
	[0072.693] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0072.693] lstrlenW (lpString=".dib") returned 4
	[0072.693] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0072.693] lstrlenW (lpString=".dic") returned 4
	[0072.694] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0072.694] lstrlenW (lpString=".dif") returned 4
	[0072.694] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0072.694] lstrlenW (lpString=".divx") returned 5
	[0072.694] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0072.694] lstrlenW (lpString=".djvu") returned 5
	[0072.695] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0072.695] lstrlenW (lpString=".dng") returned 4
	[0072.695] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0072.695] lstrlenW (lpString=".doc") returned 4
	[0072.695] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0072.695] lstrlenW (lpString=".docm") returned 5
	[0072.695] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0072.696] lstrlenW (lpString=".docx") returned 5
	[0072.696] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0072.696] lstrlenW (lpString=".dot") returned 4
	[0072.696] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0073.228] lstrlenW (lpString=".dotm") returned 5
	[0073.228] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0073.228] lstrlenW (lpString=".dotx") returned 5
	[0073.228] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0073.229] lstrlenW (lpString=".dpx") returned 4
	[0073.229] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0073.229] lstrlenW (lpString=".dqy") returned 4
	[0073.229] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0073.229] lstrlenW (lpString=".dsn") returned 4
	[0073.229] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0073.230] lstrlenW (lpString=".dt") returned 3
	[0073.230] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0073.230] lstrlenW (lpString=".dtd") returned 4
	[0073.230] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0073.230] lstrlenW (lpString=".dwg") returned 4
	[0073.230] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0073.231] lstrlenW (lpString=".dwt") returned 4
	[0073.231] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0073.231] lstrlenW (lpString=".dx") returned 3
	[0073.231] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0073.231] lstrlenW (lpString=".dxf") returned 4
	[0073.231] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0073.231] lstrlenW (lpString=".edml") returned 5
	[0073.232] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0073.232] lstrlenW (lpString=".efd") returned 4
	[0073.232] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0073.232] lstrlenW (lpString=".elf") returned 4
	[0073.232] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0073.232] lstrlenW (lpString=".emf") returned 4
	[0073.232] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0073.233] lstrlenW (lpString=".emz") returned 4
	[0073.233] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0073.233] lstrlenW (lpString=".epf") returned 4
	[0073.233] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0073.233] lstrlenW (lpString=".eps") returned 4
	[0073.233] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0073.233] lstrlenW (lpString=".epsf") returned 5
	[0073.234] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0073.234] lstrlenW (lpString=".epsp") returned 5
	[0073.234] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0073.234] lstrlenW (lpString=".erf") returned 4
	[0073.234] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0073.234] lstrlenW (lpString=".exr") returned 4
	[0073.234] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0073.234] lstrlenW (lpString=".f4v") returned 4
	[0073.235] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0073.235] lstrlenW (lpString=".fido") returned 5
	[0073.235] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0073.235] lstrcmpiW (lpString1=".flm", lpString2="") returned 1
	[0073.235] lstrcmpiW (lpString1=".flv", lpString2="") returned 1
	[0073.236] lstrcmpiW (lpString1=".frm", lpString2="") returned 1
	[0073.236] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1
	[0073.236] lstrcmpiW (lpString1=".geo", lpString2="") returned 1
	[0073.236] lstrcmpiW (lpString1=".gif", lpString2="") returned 1
	[0073.236] lstrcmpiW (lpString1=".grs", lpString2="") returned 1
	[0073.236] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1
	[0073.237] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1
	[0073.237] lstrcmpiW (lpString1=".hdr", lpString2="") returned 1
	[0073.237] lstrcmpiW (lpString1=".hpp", lpString2="") returned 1
	[0073.237] lstrcmpiW (lpString1=".hta", lpString2="") returned 1
	[0073.237] lstrcmpiW (lpString1=".htc", lpString2="") returned 1
	[0073.238] lstrcmpiW (lpString1=".htm", lpString2="") returned 1
	[0073.238] lstrcmpiW (lpString1=".html", lpString2="") returned 1
	[0073.238] lstrcmpiW (lpString1=".icb", lpString2="") returned 1
	[0073.238] lstrcmpiW (lpString1=".ics", lpString2="") returned 1
	[0073.238] lstrcmpiW (lpString1=".iff", lpString2="") returned 1
	[0073.239] lstrcmpiW (lpString1=".inc", lpString2="") returned 1
	[0073.239] lstrcmpiW (lpString1=".indd", lpString2="") returned 1
	[0073.239] lstrcmpiW (lpString1=".ini", lpString2="") returned 1
	[0073.239] lstrcmpiW (lpString1=".iqy", lpString2="") returned 1
	[0073.239] lstrcmpiW (lpString1=".j2c", lpString2="") returned 1
	[0073.240] lstrcmpiW (lpString1=".j2k", lpString2="") returned 1
	[0073.240] lstrcmpiW (lpString1=".java", lpString2="") returned 1
	[0073.240] lstrcmpiW (lpString1=".jp2", lpString2="") returned 1
	[0073.240] lstrcmpiW (lpString1=".jpc", lpString2="") returned 1
	[0073.240] lstrcmpiW (lpString1=".jpe", lpString2="") returned 1
	[0073.241] lstrcmpiW (lpString1=".jpeg", lpString2="") returned 1
	[0073.241] lstrcmpiW (lpString1=".jpf", lpString2="") returned 1
	[0073.241] lstrcmpiW (lpString1=".jpg", lpString2="") returned 1
	[0073.241] lstrcmpiW (lpString1=".jpx", lpString2="") returned 1
	[0073.242] lstrcmpiW (lpString1=".js", lpString2="BCD") returned -1
	[0073.242] lstrcmpiW (lpString1=".jsf", lpString2="") returned 1
	[0073.242] lstrcmpiW (lpString1=".json", lpString2="") returned 1
	[0073.242] lstrcmpiW (lpString1=".jsp", lpString2="") returned 1
	[0073.243] lstrcmpiW (lpString1=".kdc", lpString2="") returned 1
	[0073.243] lstrcmpiW (lpString1=".kmz", lpString2="") returned 1
	[0073.243] lstrcmpiW (lpString1=".kwm", lpString2="") returned 1
	[0073.243] lstrcmpiW (lpString1=".lasso", lpString2="") returned 1
	[0073.244] lstrcmpiW (lpString1=".lbi", lpString2="") returned 1
	[0073.244] lstrcmpiW (lpString1=".lgf", lpString2="") returned 1
	[0073.244] lstrcmpiW (lpString1=".lgp", lpString2="") returned 1
	[0073.244] lstrcmpiW (lpString1=".log", lpString2="") returned 1
	[0073.244] lstrcmpiW (lpString1=".m1v", lpString2="") returned 1
	[0073.245] lstrcmpiW (lpString1=".m4a", lpString2="") returned 1
	[0073.245] lstrcmpiW (lpString1=".m4v", lpString2="") returned 1
	[0073.245] lstrcmpiW (lpString1=".max", lpString2="") returned 1
	[0073.245] lstrcmpiW (lpString1=".md", lpString2="BCD") returned -1
	[0073.246] lstrcmpiW (lpString1=".mda", lpString2="") returned 1
	[0073.246] lstrcmpiW (lpString1=".mdb", lpString2="") returned 1
	[0073.246] lstrcmpiW (lpString1=".mde", lpString2="") returned 1
	[0073.246] lstrcmpiW (lpString1=".mdf", lpString2="") returned 1
	[0073.246] lstrcmpiW (lpString1=".mdw", lpString2="") returned 1
	[0073.247] lstrcmpiW (lpString1=".mef", lpString2="") returned 1
	[0073.247] lstrcmpiW (lpString1=".mft", lpString2="") returned 1
	[0073.247] lstrcmpiW (lpString1=".mfw", lpString2="") returned 1
	[0073.247] lstrcmpiW (lpString1=".mht", lpString2="") returned 1
	[0073.248] lstrcmpiW (lpString1=".mhtml", lpString2="") returned 1
	[0073.248] lstrcmpiW (lpString1=".mka", lpString2="") returned 1
	[0073.248] lstrcmpiW (lpString1=".mkidx", lpString2="") returned 1
	[0073.248] lstrcmpiW (lpString1=".mkv", lpString2="") returned 1
	[0073.248] lstrcmpiW (lpString1=".mos", lpString2="") returned 1
	[0073.249] lstrcmpiW (lpString1=".mov", lpString2="") returned 1
	[0073.249] lstrcmpiW (lpString1=".mp3", lpString2="") returned 1
	[0073.249] lstrcmpiW (lpString1=".mp4", lpString2="") returned 1
	[0073.249] lstrcmpiW (lpString1=".mpeg", lpString2="") returned 1
	[0073.249] lstrcmpiW (lpString1=".mpg", lpString2="") returned 1
	[0073.250] lstrcmpiW (lpString1=".mpv", lpString2="") returned 1
	[0073.250] lstrcmpiW (lpString1=".mrw", lpString2="") returned 1
	[0073.250] lstrcmpiW (lpString1=".msg", lpString2="") returned 1
	[0073.250] lstrcmpiW (lpString1=".mxl", lpString2="") returned 1
	[0073.250] lstrcmpiW (lpString1=".myd", lpString2="") returned 1
	[0073.251] lstrcmpiW (lpString1=".myi", lpString2="") returned 1
	[0073.251] lstrcmpiW (lpString1=".nef", lpString2="") returned 1
	[0073.251] lstrcmpiW (lpString1=".nrw", lpString2="") returned 1
	[0073.251] lstrcmpiW (lpString1=".obj", lpString2="") returned 1
	[0073.252] lstrcmpiW (lpString1=".odb", lpString2="") returned 1
	[0073.252] lstrcmpiW (lpString1=".odc", lpString2="") returned 1
	[0073.252] lstrcmpiW (lpString1=".odm", lpString2="") returned 1
	[0073.252] lstrcmpiW (lpString1=".odp", lpString2="") returned 1
	[0073.253] lstrcmpiW (lpString1=".ods", lpString2="") returned 1
	[0073.253] lstrcmpiW (lpString1=".oft", lpString2="") returned 1
	[0073.253] lstrcmpiW (lpString1=".one", lpString2="") returned 1
	[0073.253] lstrcmpiW (lpString1=".onepkg", lpString2="") returned 1
	[0073.254] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1
	[0073.254] lstrcmpiW (lpString1=".opt", lpString2="") returned 1
	[0073.254] lstrcmpiW (lpString1=".oqy", lpString2="") returned 1
	[0073.254] lstrcmpiW (lpString1=".orf", lpString2="") returned 1
	[0073.255] lstrcmpiW (lpString1=".p12", lpString2="") returned 1
	[0073.255] lstrcmpiW (lpString1=".p7b", lpString2="") returned 1
	[0073.255] lstrcmpiW (lpString1=".p7c", lpString2="") returned 1
	[0073.255] lstrcmpiW (lpString1=".pam", lpString2="") returned 1
	[0073.256] lstrcmpiW (lpString1=".pbm", lpString2="") returned 1
	[0073.256] lstrcmpiW (lpString1=".pct", lpString2="") returned 1
	[0073.256] lstrcmpiW (lpString1=".pcx", lpString2="") returned 1
	[0073.256] lstrcmpiW (lpString1=".pdd", lpString2="") returned 1
	[0073.257] lstrcmpiW (lpString1=".pdf", lpString2="") returned 1
	[0073.257] lstrcmpiW (lpString1=".pdp", lpString2="") returned 1
	[0073.257] lstrcmpiW (lpString1=".pef", lpString2="") returned 1
	[0073.257] lstrcmpiW (lpString1=".pem", lpString2="") returned 1
	[0073.257] lstrcmpiW (lpString1=".pff", lpString2="") returned 1
	[0073.258] lstrcmpiW (lpString1=".pfm", lpString2="") returned 1
	[0073.262] lstrcmpiW (lpString1=".pfx", lpString2="") returned 1
	[0073.263] lstrcmpiW (lpString1=".pgm", lpString2="") returned 1
	[0073.263] lstrcmpiW (lpString1=".php", lpString2="") returned 1
	[0073.263] lstrcmpiW (lpString1=".php3", lpString2="") returned 1
	[0073.263] lstrcmpiW (lpString1=".php4", lpString2="") returned 1
	[0073.264] lstrcmpiW (lpString1=".php5", lpString2="") returned 1
	[0073.264] lstrcmpiW (lpString1=".phtml", lpString2="") returned 1
	[0073.264] lstrcmpiW (lpString1=".pict", lpString2="") returned 1
	[0073.264] lstrcmpiW (lpString1=".pl", lpString2="BCD") returned -1
	[0073.265] lstrcmpiW (lpString1=".pls", lpString2="") returned 1
	[0073.265] lstrcmpiW (lpString1=".pm", lpString2="BCD") returned -1
	[0073.265] lstrcmpiW (lpString1=".png", lpString2="") returned 1
	[0073.265] lstrcmpiW (lpString1=".pnm", lpString2="") returned 1
	[0073.266] lstrcmpiW (lpString1=".pot", lpString2="") returned 1
	[0073.266] lstrcmpiW (lpString1=".potm", lpString2="") returned 1
	[0073.266] lstrcmpiW (lpString1=".potx", lpString2="") returned 1
	[0073.266] lstrcmpiW (lpString1=".ppa", lpString2="") returned 1
	[0073.267] lstrcmpiW (lpString1=".ppam", lpString2="") returned 1
	[0073.267] lstrcmpiW (lpString1=".ppm", lpString2="") returned 1
	[0073.267] lstrcmpiW (lpString1=".pps", lpString2="") returned 1
	[0073.268] lstrcmpiW (lpString1=".ppsm", lpString2="") returned 1
	[0073.268] lstrcmpiW (lpString1=".ppt", lpString2="") returned 1
	[0073.268] lstrcmpiW (lpString1=".pptm", lpString2="") returned 1
	[0073.268] lstrcmpiW (lpString1=".pptx", lpString2="") returned 1
	[0073.269] lstrcmpiW (lpString1=".prn", lpString2="") returned 1
	[0073.269] lstrcmpiW (lpString1=".ps", lpString2="BCD") returned -1
	[0073.269] lstrcmpiW (lpString1=".psb", lpString2="") returned 1
	[0073.269] lstrcmpiW (lpString1=".psd", lpString2="") returned 1
	[0073.269] lstrcmpiW (lpString1=".pst", lpString2="") returned 1
	[0073.270] lstrcmpiW (lpString1=".ptx", lpString2="") returned 1
	[0073.270] lstrcmpiW (lpString1=".pub", lpString2="") returned 1
	[0073.270] lstrcmpiW (lpString1=".pwm", lpString2="") returned 1
	[0073.270] lstrcmpiW (lpString1=".pxr", lpString2="") returned 1
	[0073.271] lstrcmpiW (lpString1=".py", lpString2="BCD") returned -1
	[0073.271] lstrcmpiW (lpString1=".qt", lpString2="BCD") returned -1
	[0073.271] lstrcmpiW (lpString1=".r3d", lpString2="") returned 1
	[0073.271] lstrcmpiW (lpString1=".raf", lpString2="") returned 1
	[0073.272] lstrcmpiW (lpString1=".rar", lpString2="") returned 1
	[0073.273] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0073.445] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0074.909] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.909] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0074.914] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0074.914] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0074.914] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0074.915] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13
	[0074.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1
	[0074.915] lstrlenW (lpString="da-DK") returned 5
	[0074.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1
	[0074.916] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0074.916] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13
	[0074.916] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0074.917] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.917] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0074.917] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.918] lstrlenW (lpString=".1cd") returned 4
	[0074.918] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.918] lstrlenW (lpString=".3ds") returned 4
	[0074.918] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0074.918] lstrlenW (lpString=".3fr") returned 4
	[0074.919] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0074.919] lstrlenW (lpString=".3g2") returned 4
	[0074.919] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0074.919] lstrlenW (lpString=".3gp") returned 4
	[0074.919] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0074.920] lstrlenW (lpString=".7z") returned 3
	[0074.920] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.920] lstrlenW (lpString=".accda") returned 6
	[0074.920] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0074.920] lstrlenW (lpString=".accdb") returned 6
	[0074.920] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0074.921] lstrlenW (lpString=".accdc") returned 6
	[0074.921] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0074.921] lstrlenW (lpString=".accde") returned 6
	[0074.921] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0074.921] lstrlenW (lpString=".accdt") returned 6
	[0074.921] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0074.922] lstrlenW (lpString=".accdw") returned 6
	[0074.922] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0074.922] lstrlenW (lpString=".adb") returned 4
	[0074.922] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0074.922] lstrlenW (lpString=".adp") returned 4
	[0074.923] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0074.923] lstrlenW (lpString=".ai") returned 3
	[0074.923] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0074.923] lstrlenW (lpString=".ai3") returned 4
	[0074.924] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0074.924] lstrlenW (lpString=".ai4") returned 4
	[0074.924] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0074.924] lstrlenW (lpString=".ai5") returned 4
	[0074.924] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0074.925] lstrlenW (lpString=".ai6") returned 4
	[0074.925] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0074.925] lstrlenW (lpString=".ai7") returned 4
	[0074.925] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0074.925] lstrlenW (lpString=".ai8") returned 4
	[0074.926] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0074.926] lstrlenW (lpString=".anim") returned 5
	[0074.926] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0074.926] lstrlenW (lpString=".arw") returned 4
	[0074.926] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0074.926] lstrlenW (lpString=".as") returned 3
	[0074.927] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0074.927] lstrlenW (lpString=".asa") returned 4
	[0074.929] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0074.929] lstrlenW (lpString=".asc") returned 4
	[0074.929] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0074.929] lstrlenW (lpString=".ascx") returned 5
	[0074.929] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0074.929] lstrlenW (lpString=".asm") returned 4
	[0074.930] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0074.930] lstrlenW (lpString=".asmx") returned 5
	[0074.930] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0074.930] lstrlenW (lpString=".asp") returned 4
	[0074.930] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0074.931] lstrlenW (lpString=".aspx") returned 5
	[0074.931] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0074.931] lstrlenW (lpString=".asr") returned 4
	[0074.931] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0074.931] lstrlenW (lpString=".asx") returned 4
	[0074.931] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0074.932] lstrlenW (lpString=".avi") returned 4
	[0074.932] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0074.932] lstrlenW (lpString=".avs") returned 4
	[0074.932] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0074.932] lstrlenW (lpString=".backup") returned 7
	[0074.932] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0074.932] lstrlenW (lpString=".bak") returned 4
	[0074.933] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0074.933] lstrlenW (lpString=".bay") returned 4
	[0074.933] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0074.933] lstrlenW (lpString=".bd") returned 3
	[0074.933] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0074.933] lstrlenW (lpString=".bin") returned 4
	[0074.934] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0074.934] lstrlenW (lpString=".bmp") returned 4
	[0074.934] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0074.934] lstrlenW (lpString=".bz2") returned 4
	[0074.934] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.934] lstrlenW (lpString=".c") returned 2
	[0074.935] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0074.935] lstrlenW (lpString=".cdr") returned 4
	[0074.935] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0074.935] lstrlenW (lpString=".cer") returned 4
	[0074.935] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0074.935] lstrlenW (lpString=".cf") returned 3
	[0074.936] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0074.936] lstrlenW (lpString=".cfc") returned 4
	[0074.936] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0074.936] lstrlenW (lpString=".cfm") returned 4
	[0074.936] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0074.936] lstrlenW (lpString=".cfml") returned 5
	[0074.936] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0074.937] lstrlenW (lpString=".cfu") returned 4
	[0074.937] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0074.937] lstrlenW (lpString=".chm") returned 4
	[0074.937] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0074.937] lstrlenW (lpString=".cin") returned 4
	[0074.937] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0074.938] lstrlenW (lpString=".class") returned 6
	[0074.938] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0074.938] lstrlenW (lpString=".clx") returned 4
	[0074.938] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0074.938] lstrlenW (lpString=".config") returned 7
	[0074.938] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0074.938] lstrlenW (lpString=".cpp") returned 4
	[0074.939] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0074.939] lstrlenW (lpString=".cr2") returned 4
	[0074.939] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0074.939] lstrlenW (lpString=".crt") returned 4
	[0074.939] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0074.939] lstrlenW (lpString=".crw") returned 4
	[0074.940] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0074.940] lstrlenW (lpString=".cs") returned 3
	[0074.940] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0074.940] lstrlenW (lpString=".css") returned 4
	[0074.940] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0074.940] lstrlenW (lpString=".csv") returned 4
	[0074.940] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0074.941] lstrlenW (lpString=".cub") returned 4
	[0074.941] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0074.941] lstrlenW (lpString=".dae") returned 4
	[0074.941] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0074.941] lstrlenW (lpString=".dat") returned 4
	[0074.941] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0074.941] lstrlenW (lpString=".db") returned 3
	[0074.942] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0074.942] lstrlenW (lpString=".dbf") returned 4
	[0074.942] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.942] lstrlenW (lpString=".dbx") returned 4
	[0074.942] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0074.942] lstrlenW (lpString=".dc3") returned 4
	[0074.955] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0074.955] lstrlenW (lpString=".dcm") returned 4
	[0074.955] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0074.955] lstrlenW (lpString=".dcr") returned 4
	[0074.955] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0074.955] lstrlenW (lpString=".der") returned 4
	[0074.956] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0074.956] lstrlenW (lpString=".dib") returned 4
	[0074.956] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0074.956] lstrlenW (lpString=".dic") returned 4
	[0074.956] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0074.956] lstrlenW (lpString=".dif") returned 4
	[0074.956] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0074.957] lstrlenW (lpString=".divx") returned 5
	[0074.957] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0074.957] lstrlenW (lpString=".djvu") returned 5
	[0074.957] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0074.957] lstrlenW (lpString=".dng") returned 4
	[0074.957] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0074.957] lstrlenW (lpString=".doc") returned 4
	[0074.958] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.958] lstrlenW (lpString=".docm") returned 5
	[0074.958] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0074.958] lstrlenW (lpString=".docx") returned 5
	[0074.958] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.976] lstrlenW (lpString=".dot") returned 4
	[0074.976] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0074.976] lstrlenW (lpString=".dotm") returned 5
	[0074.976] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0074.977] lstrlenW (lpString=".dotx") returned 5
	[0074.977] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0074.977] lstrlenW (lpString=".dpx") returned 4
	[0074.977] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0074.977] lstrlenW (lpString=".dqy") returned 4
	[0074.978] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0074.978] lstrlenW (lpString=".dsn") returned 4
	[0074.978] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0074.978] lstrlenW (lpString=".dt") returned 3
	[0074.978] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0074.978] lstrlenW (lpString=".dtd") returned 4
	[0074.979] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0074.979] lstrlenW (lpString=".dwg") returned 4
	[0074.979] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0074.979] lstrlenW (lpString=".dwt") returned 4
	[0074.979] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0074.979] lstrlenW (lpString=".dx") returned 3
	[0074.980] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0074.980] lstrlenW (lpString=".dxf") returned 4
	[0074.980] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0074.980] lstrlenW (lpString=".edml") returned 5
	[0074.980] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0074.980] lstrlenW (lpString=".efd") returned 4
	[0074.981] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0074.981] lstrlenW (lpString=".elf") returned 4
	[0074.981] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0074.981] lstrlenW (lpString=".emf") returned 4
	[0074.981] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0074.981] lstrlenW (lpString=".emz") returned 4
	[0074.981] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0074.982] lstrlenW (lpString=".epf") returned 4
	[0074.982] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0074.982] lstrlenW (lpString=".eps") returned 4
	[0074.982] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0074.982] lstrlenW (lpString=".epsf") returned 5
	[0074.982] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0074.983] lstrlenW (lpString=".epsp") returned 5
	[0074.983] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0074.983] lstrlenW (lpString=".erf") returned 4
	[0074.983] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0074.983] lstrlenW (lpString=".exr") returned 4
	[0074.983] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0074.984] lstrlenW (lpString=".f4v") returned 4
	[0074.984] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0074.984] lstrlenW (lpString=".fido") returned 5
	[0074.984] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0074.984] lstrlenW (lpString=".flm") returned 4
	[0074.984] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0074.985] lstrlenW (lpString=".flv") returned 4
	[0074.985] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0074.985] lstrlenW (lpString=".frm") returned 4
	[0074.985] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0074.985] lstrlenW (lpString=".fxg") returned 4
	[0074.985] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0074.986] lstrlenW (lpString=".geo") returned 4
	[0074.986] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0074.986] lstrlenW (lpString=".gif") returned 4
	[0074.986] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0074.986] lstrlenW (lpString=".grs") returned 4
	[0074.986] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0074.987] lstrlenW (lpString=".gz") returned 3
	[0074.987] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0074.987] lstrlenW (lpString=".h") returned 2
	[0074.987] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0074.987] lstrlenW (lpString=".hdr") returned 4
	[0074.988] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0074.988] lstrlenW (lpString=".hpp") returned 4
	[0074.988] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0074.988] lstrlenW (lpString=".hta") returned 4
	[0074.988] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0074.988] lstrlenW (lpString=".htc") returned 4
	[0074.989] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0074.989] lstrlenW (lpString=".htm") returned 4
	[0074.989] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0074.989] lstrlenW (lpString=".html") returned 5
	[0074.989] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0075.011] lstrlenW (lpString=".icb") returned 4
	[0075.011] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0075.011] lstrlenW (lpString=".ics") returned 4
	[0075.011] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0075.011] lstrlenW (lpString=".iff") returned 4
	[0075.012] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0075.012] lstrlenW (lpString=".inc") returned 4
	[0075.012] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0075.012] lstrlenW (lpString=".indd") returned 5
	[0075.012] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0075.012] lstrlenW (lpString=".ini") returned 4
	[0075.013] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0075.013] lstrlenW (lpString=".iqy") returned 4
	[0075.013] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0075.013] lstrlenW (lpString=".j2c") returned 4
	[0075.013] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0075.013] lstrlenW (lpString=".j2k") returned 4
	[0075.013] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0075.014] lstrlenW (lpString=".java") returned 5
	[0075.014] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0075.014] lstrlenW (lpString=".jp2") returned 4
	[0075.014] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0075.014] lstrlenW (lpString=".jpc") returned 4
	[0075.014] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0075.015] lstrlenW (lpString=".jpe") returned 4
	[0075.015] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0075.015] lstrlenW (lpString=".jpeg") returned 5
	[0075.015] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0075.015] lstrlenW (lpString=".jpf") returned 4
	[0075.015] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0075.016] lstrlenW (lpString=".jpg") returned 4
	[0075.016] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.016] lstrlenW (lpString=".jpx") returned 4
	[0075.016] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0075.016] lstrlenW (lpString=".js") returned 3
	[0075.016] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0075.017] lstrlenW (lpString=".jsf") returned 4
	[0075.017] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0075.017] lstrlenW (lpString=".json") returned 5
	[0075.017] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0075.017] lstrlenW (lpString=".jsp") returned 4
	[0075.017] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0075.018] lstrlenW (lpString=".kdc") returned 4
	[0075.018] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0075.018] lstrlenW (lpString=".kmz") returned 4
	[0075.018] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0075.018] lstrlenW (lpString=".kwm") returned 4
	[0075.018] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0075.019] lstrlenW (lpString=".lasso") returned 6
	[0075.019] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0075.019] lstrlenW (lpString=".lbi") returned 4
	[0075.019] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0075.019] lstrlenW (lpString=".lgf") returned 4
	[0075.020] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0075.020] lstrlenW (lpString=".lgp") returned 4
	[0075.020] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0075.020] lstrlenW (lpString=".log") returned 4
	[0075.020] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0075.020] lstrlenW (lpString=".m1v") returned 4
	[0075.020] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0075.021] lstrlenW (lpString=".m4a") returned 4
	[0075.021] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0075.021] lstrlenW (lpString=".m4v") returned 4
	[0075.021] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0075.021] lstrlenW (lpString=".max") returned 4
	[0075.022] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0075.022] lstrlenW (lpString=".md") returned 3
	[0075.022] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0075.022] lstrlenW (lpString=".mda") returned 4
	[0075.022] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0075.022] lstrlenW (lpString=".mdb") returned 4
	[0075.022] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0075.023] lstrlenW (lpString=".mde") returned 4
	[0075.023] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0075.023] lstrlenW (lpString=".mdf") returned 4
	[0075.023] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0075.023] lstrlenW (lpString=".mdw") returned 4
	[0075.023] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0075.024] lstrlenW (lpString=".mef") returned 4
	[0075.024] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0075.024] lstrlenW (lpString=".mft") returned 4
	[0075.024] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0075.024] lstrlenW (lpString=".mfw") returned 4
	[0075.024] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0075.024] lstrlenW (lpString=".mht") returned 4
	[0075.025] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0075.025] lstrlenW (lpString=".mhtml") returned 6
	[0075.025] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0075.025] lstrlenW (lpString=".mka") returned 4
	[0075.025] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0075.025] lstrlenW (lpString=".mkidx") returned 6
	[0075.025] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0075.026] lstrlenW (lpString=".mkv") returned 4
	[0075.026] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0075.026] lstrlenW (lpString=".mos") returned 4
	[0075.026] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0075.026] lstrlenW (lpString=".mov") returned 4
	[0075.026] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0075.026] lstrlenW (lpString=".mp3") returned 4
	[0075.026] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0075.027] lstrlenW (lpString=".mp4") returned 4
	[0075.027] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0075.027] lstrlenW (lpString=".mpeg") returned 5
	[0075.027] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0075.027] lstrlenW (lpString=".mpg") returned 4
	[0075.027] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0075.027] lstrlenW (lpString=".mpv") returned 4
	[0075.027] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0075.028] lstrlenW (lpString=".mrw") returned 4
	[0075.028] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0075.028] lstrlenW (lpString=".msg") returned 4
	[0075.028] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0075.028] lstrlenW (lpString=".mxl") returned 4
	[0075.028] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0075.028] lstrlenW (lpString=".myd") returned 4
	[0075.028] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0075.029] lstrlenW (lpString=".myi") returned 4
	[0075.029] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0075.029] lstrlenW (lpString=".nef") returned 4
	[0075.029] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0075.029] lstrlenW (lpString=".nrw") returned 4
	[0075.029] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0075.029] lstrlenW (lpString=".obj") returned 4
	[0075.029] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0075.029] lstrlenW (lpString=".odb") returned 4
	[0075.030] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0075.030] lstrlenW (lpString=".odc") returned 4
	[0075.030] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0075.030] lstrlenW (lpString=".odm") returned 4
	[0075.030] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0075.030] lstrlenW (lpString=".odp") returned 4
	[0075.030] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0075.030] lstrlenW (lpString=".ods") returned 4
	[0075.031] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0075.031] lstrlenW (lpString=".oft") returned 4
	[0075.031] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0075.031] lstrlenW (lpString=".one") returned 4
	[0075.031] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0075.031] lstrlenW (lpString=".onepkg") returned 7
	[0075.031] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0075.031] lstrlenW (lpString=".onetoc2") returned 8
	[0075.032] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0075.032] lstrlenW (lpString=".opt") returned 4
	[0075.032] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0075.032] lstrlenW (lpString=".oqy") returned 4
	[0075.032] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0075.032] lstrlenW (lpString=".orf") returned 4
	[0075.032] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0075.032] lstrlenW (lpString=".p12") returned 4
	[0075.033] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0075.033] lstrlenW (lpString=".p7b") returned 4
	[0075.033] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0075.033] lstrlenW (lpString=".p7c") returned 4
	[0075.033] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0075.033] lstrlenW (lpString=".pam") returned 4
	[0075.033] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0075.034] lstrlenW (lpString=".pbm") returned 4
	[0075.034] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0075.034] lstrlenW (lpString=".pct") returned 4
	[0075.034] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0075.034] lstrlenW (lpString=".pcx") returned 4
	[0075.034] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0075.034] lstrlenW (lpString=".pdd") returned 4
	[0075.034] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0075.035] lstrlenW (lpString=".pdf") returned 4
	[0075.035] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.035] lstrlenW (lpString=".pdp") returned 4
	[0075.035] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0075.035] lstrlenW (lpString=".pef") returned 4
	[0075.035] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0075.035] lstrlenW (lpString=".pem") returned 4
	[0075.036] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0075.036] lstrlenW (lpString=".pff") returned 4
	[0075.036] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0075.036] lstrlenW (lpString=".pfm") returned 4
	[0075.036] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0075.075] lstrlenW (lpString=".pfx") returned 4
	[0075.075] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0075.076] lstrlenW (lpString=".pgm") returned 4
	[0075.076] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0075.076] lstrlenW (lpString=".php") returned 4
	[0075.076] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0075.076] lstrlenW (lpString=".php3") returned 5
	[0075.076] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0075.076] lstrlenW (lpString=".php4") returned 5
	[0075.077] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0075.077] lstrlenW (lpString=".php5") returned 5
	[0075.077] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0075.077] lstrlenW (lpString=".phtml") returned 6
	[0075.077] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0075.077] lstrlenW (lpString=".pict") returned 5
	[0075.078] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0075.078] lstrlenW (lpString=".pl") returned 3
	[0075.078] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0075.078] lstrlenW (lpString=".pls") returned 4
	[0075.078] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0075.078] lstrlenW (lpString=".pm") returned 3
	[0075.078] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0075.079] lstrlenW (lpString=".png") returned 4
	[0075.079] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0075.079] lstrlenW (lpString=".pnm") returned 4
	[0075.079] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0075.079] lstrlenW (lpString=".pot") returned 4
	[0075.079] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0075.079] lstrlenW (lpString=".potm") returned 5
	[0075.080] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0075.080] lstrlenW (lpString=".potx") returned 5
	[0075.080] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0075.080] lstrlenW (lpString=".ppa") returned 4
	[0075.080] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0075.080] lstrlenW (lpString=".ppam") returned 5
	[0075.080] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0075.081] lstrlenW (lpString=".ppm") returned 4
	[0075.081] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0075.081] lstrlenW (lpString=".pps") returned 4
	[0075.081] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0075.081] lstrlenW (lpString=".ppsm") returned 5
	[0075.081] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0075.082] lstrlenW (lpString=".ppt") returned 4
	[0075.082] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.082] lstrlenW (lpString=".pptm") returned 5
	[0075.082] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0075.082] lstrlenW (lpString=".pptx") returned 5
	[0075.082] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0075.082] lstrlenW (lpString=".prn") returned 4
	[0075.083] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0075.083] lstrlenW (lpString=".ps") returned 3
	[0075.083] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0075.084] lstrlenW (lpString=".psb") returned 4
	[0075.084] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0075.084] lstrlenW (lpString=".psd") returned 4
	[0075.084] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0075.084] lstrlenW (lpString=".pst") returned 4
	[0075.084] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0075.085] lstrlenW (lpString=".ptx") returned 4
	[0075.085] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0075.085] lstrlenW (lpString=".pub") returned 4
	[0075.085] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0075.085] lstrlenW (lpString=".pwm") returned 4
	[0075.085] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0075.086] lstrlenW (lpString=".pxr") returned 4
	[0075.086] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0075.086] lstrlenW (lpString=".py") returned 3
	[0075.086] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0075.086] lstrlenW (lpString=".qt") returned 3
	[0075.086] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0075.087] lstrlenW (lpString=".r3d") returned 4
	[0075.087] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0075.087] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.087] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.088] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0075.088] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.088] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.089] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.089] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.090] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.090] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.090] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0075.091] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.091] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.100] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.101] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.101] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.102] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.102] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0075.102] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.103] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.103] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.103] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.104] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.104] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.104] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0075.105] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.105] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.131] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.131] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.132] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.132] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.132] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0075.133] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.133] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.134] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.134] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.134] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.135] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.135] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0075.135] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.136] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.137] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.137] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0075.138] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.138] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.138] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0075.139] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.139] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.140] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.141] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.141] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.141] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.142] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0075.142] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.142] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.143] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.143] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.144] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.144] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.144] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0075.145] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.145] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.146] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.147] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.147] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.148] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.148] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0075.148] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.149] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.149] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.149] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.150] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.150] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.150] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0075.151] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.151] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0075.235] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.236] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.236] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0075.237] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.237] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0075.238] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.238] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0075.239] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.239] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.240] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.240] lstrlenW (lpString=".1cd") returned 4
	[0075.240] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.240] lstrlenW (lpString=".3ds") returned 4
	[0075.240] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0075.241] lstrlenW (lpString=".3fr") returned 4
	[0075.241] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0075.241] lstrlenW (lpString=".3g2") returned 4
	[0075.241] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0075.241] lstrlenW (lpString=".3gp") returned 4
	[0075.242] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0075.242] lstrlenW (lpString=".7z") returned 3
	[0075.242] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.242] lstrlenW (lpString=".accda") returned 6
	[0075.242] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0075.242] lstrlenW (lpString=".accdb") returned 6
	[0075.243] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0075.243] lstrlenW (lpString=".accdc") returned 6
	[0075.243] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0075.243] lstrlenW (lpString=".accde") returned 6
	[0075.243] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0075.244] lstrlenW (lpString=".accdt") returned 6
	[0075.244] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0075.244] lstrlenW (lpString=".accdw") returned 6
	[0075.244] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0075.244] lstrlenW (lpString=".adb") returned 4
	[0075.244] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0075.245] lstrlenW (lpString=".adp") returned 4
	[0075.245] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0075.245] lstrlenW (lpString=".ai") returned 3
	[0075.245] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0075.245] lstrlenW (lpString=".ai3") returned 4
	[0075.246] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0075.246] lstrlenW (lpString=".ai4") returned 4
	[0075.246] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0075.246] lstrlenW (lpString=".ai5") returned 4
	[0075.246] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0075.246] lstrlenW (lpString=".ai6") returned 4
	[0075.246] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0075.247] lstrlenW (lpString=".ai7") returned 4
	[0075.247] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0075.247] lstrlenW (lpString=".ai8") returned 4
	[0075.247] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0075.247] lstrlenW (lpString=".anim") returned 5
	[0075.247] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0075.248] lstrlenW (lpString=".arw") returned 4
	[0075.248] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0075.248] lstrlenW (lpString=".as") returned 3
	[0075.248] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0075.248] lstrlenW (lpString=".asa") returned 4
	[0075.248] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0075.249] lstrlenW (lpString=".asc") returned 4
	[0075.249] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0075.249] lstrlenW (lpString=".ascx") returned 5
	[0075.249] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0075.249] lstrlenW (lpString=".asm") returned 4
	[0075.249] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0075.249] lstrlenW (lpString=".asmx") returned 5
	[0075.250] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0075.250] lstrlenW (lpString=".asp") returned 4
	[0075.250] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0075.250] lstrlenW (lpString=".aspx") returned 5
	[0075.250] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0075.250] lstrlenW (lpString=".asr") returned 4
	[0075.250] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0075.251] lstrlenW (lpString=".asx") returned 4
	[0075.251] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0075.251] lstrlenW (lpString=".avi") returned 4
	[0075.251] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0075.251] lstrlenW (lpString=".avs") returned 4
	[0075.251] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0075.252] lstrlenW (lpString=".backup") returned 7
	[0075.252] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0075.252] lstrlenW (lpString=".bak") returned 4
	[0075.252] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0075.252] lstrlenW (lpString=".bay") returned 4
	[0075.252] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0075.252] lstrlenW (lpString=".bd") returned 3
	[0075.253] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0075.253] lstrlenW (lpString=".bin") returned 4
	[0075.253] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0075.253] lstrlenW (lpString=".bmp") returned 4
	[0075.253] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0075.253] lstrlenW (lpString=".bz2") returned 4
	[0075.254] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.254] lstrlenW (lpString=".c") returned 2
	[0075.254] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0075.254] lstrlenW (lpString=".cdr") returned 4
	[0075.254] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0075.254] lstrlenW (lpString=".cer") returned 4
	[0075.255] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0075.255] lstrlenW (lpString=".cf") returned 3
	[0075.255] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0075.255] lstrlenW (lpString=".cfc") returned 4
	[0075.255] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0075.255] lstrlenW (lpString=".cfm") returned 4
	[0075.255] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0075.256] lstrlenW (lpString=".cfml") returned 5
	[0075.256] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0075.256] lstrlenW (lpString=".cfu") returned 4
	[0075.256] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0075.256] lstrlenW (lpString=".chm") returned 4
	[0075.256] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0075.257] lstrlenW (lpString=".cin") returned 4
	[0075.257] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0075.257] lstrlenW (lpString=".class") returned 6
	[0075.257] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0075.257] lstrlenW (lpString=".clx") returned 4
	[0075.257] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0075.257] lstrlenW (lpString=".config") returned 7
	[0075.258] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0075.258] lstrlenW (lpString=".cpp") returned 4
	[0075.258] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0075.258] lstrlenW (lpString=".cr2") returned 4
	[0075.258] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0075.258] lstrlenW (lpString=".crt") returned 4
	[0075.258] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0075.259] lstrlenW (lpString=".crw") returned 4
	[0075.259] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0075.259] lstrlenW (lpString=".cs") returned 3
	[0075.259] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0075.259] lstrlenW (lpString=".css") returned 4
	[0075.259] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0075.260] lstrlenW (lpString=".csv") returned 4
	[0075.260] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0075.260] lstrlenW (lpString=".cub") returned 4
	[0075.260] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0075.260] lstrlenW (lpString=".dae") returned 4
	[0075.260] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0075.260] lstrlenW (lpString=".dat") returned 4
	[0075.261] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0075.261] lstrlenW (lpString=".db") returned 3
	[0075.261] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0075.261] lstrlenW (lpString=".dbf") returned 4
	[0075.261] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.261] lstrlenW (lpString=".dbx") returned 4
	[0075.262] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0075.262] lstrlenW (lpString=".dc3") returned 4
	[0075.262] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0075.262] lstrlenW (lpString=".dcm") returned 4
	[0075.262] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0075.262] lstrlenW (lpString=".dcr") returned 4
	[0075.262] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0075.263] lstrlenW (lpString=".der") returned 4
	[0075.263] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0075.263] lstrlenW (lpString=".dib") returned 4
	[0075.263] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0075.263] lstrlenW (lpString=".dic") returned 4
	[0075.263] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0075.263] lstrlenW (lpString=".dif") returned 4
	[0075.264] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0075.264] lstrlenW (lpString=".divx") returned 5
	[0075.264] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0075.264] lstrlenW (lpString=".djvu") returned 5
	[0075.264] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0075.264] lstrlenW (lpString=".dng") returned 4
	[0075.264] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0075.265] lstrlenW (lpString=".doc") returned 4
	[0075.265] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.265] lstrlenW (lpString=".docm") returned 5
	[0075.265] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0075.265] lstrlenW (lpString=".docx") returned 5
	[0075.265] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.265] lstrlenW (lpString=".dot") returned 4
	[0075.266] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0075.266] lstrlenW (lpString=".dotm") returned 5
	[0075.266] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0075.266] lstrlenW (lpString=".dotx") returned 5
	[0075.266] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0075.266] lstrlenW (lpString=".dpx") returned 4
	[0075.266] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0075.267] lstrlenW (lpString=".dqy") returned 4
	[0075.267] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0075.267] lstrlenW (lpString=".dsn") returned 4
	[0075.267] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0075.267] lstrlenW (lpString=".dt") returned 3
	[0075.267] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0075.268] lstrlenW (lpString=".dtd") returned 4
	[0075.268] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0075.268] lstrlenW (lpString=".dwg") returned 4
	[0075.268] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0075.268] lstrlenW (lpString=".dwt") returned 4
	[0075.268] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0075.268] lstrlenW (lpString=".dx") returned 3
	[0075.269] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0075.269] lstrlenW (lpString=".dxf") returned 4
	[0075.269] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0075.269] lstrlenW (lpString=".edml") returned 5
	[0075.269] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0075.269] lstrlenW (lpString=".efd") returned 4
	[0075.270] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0075.270] lstrlenW (lpString=".elf") returned 4
	[0075.270] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0075.270] lstrlenW (lpString=".emf") returned 4
	[0075.270] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0075.329] lstrlenW (lpString=".emz") returned 4
	[0075.329] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0075.329] lstrlenW (lpString=".epf") returned 4
	[0075.329] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0075.330] lstrlenW (lpString=".eps") returned 4
	[0075.330] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0075.330] lstrlenW (lpString=".epsf") returned 5
	[0075.330] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0075.330] lstrlenW (lpString=".epsp") returned 5
	[0075.330] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0075.331] lstrlenW (lpString=".erf") returned 4
	[0075.331] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0075.331] lstrlenW (lpString=".exr") returned 4
	[0075.331] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0075.331] lstrlenW (lpString=".f4v") returned 4
	[0075.331] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0075.331] lstrlenW (lpString=".fido") returned 5
	[0075.332] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0075.332] lstrlenW (lpString=".flm") returned 4
	[0075.332] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0075.332] lstrlenW (lpString=".flv") returned 4
	[0075.332] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0075.332] lstrlenW (lpString=".frm") returned 4
	[0075.333] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0075.333] lstrlenW (lpString=".fxg") returned 4
	[0075.333] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0075.334] lstrlenW (lpString=".geo") returned 4
	[0075.334] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0075.334] lstrlenW (lpString=".gif") returned 4
	[0075.334] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0075.334] lstrlenW (lpString=".grs") returned 4
	[0075.334] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0075.335] lstrlenW (lpString=".gz") returned 3
	[0075.335] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0075.335] lstrlenW (lpString=".h") returned 2
	[0075.335] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0075.335] lstrlenW (lpString=".hdr") returned 4
	[0075.335] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0075.335] lstrlenW (lpString=".hpp") returned 4
	[0075.336] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0075.336] lstrlenW (lpString=".hta") returned 4
	[0075.336] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0075.336] lstrlenW (lpString=".htc") returned 4
	[0075.336] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0075.336] lstrlenW (lpString=".htm") returned 4
	[0075.336] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0075.337] lstrlenW (lpString=".html") returned 5
	[0075.337] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0075.337] lstrlenW (lpString=".icb") returned 4
	[0075.337] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0075.337] lstrlenW (lpString=".ics") returned 4
	[0075.337] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0075.338] lstrlenW (lpString=".iff") returned 4
	[0075.338] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0075.338] lstrlenW (lpString=".inc") returned 4
	[0075.338] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0075.338] lstrlenW (lpString=".indd") returned 5
	[0075.338] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0075.338] lstrlenW (lpString=".ini") returned 4
	[0075.339] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0075.339] lstrlenW (lpString=".iqy") returned 4
	[0075.339] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0075.339] lstrlenW (lpString=".j2c") returned 4
	[0075.339] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0075.339] lstrlenW (lpString=".j2k") returned 4
	[0075.339] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0075.340] lstrlenW (lpString=".java") returned 5
	[0075.340] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0075.340] lstrlenW (lpString=".jp2") returned 4
	[0075.340] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0075.340] lstrlenW (lpString=".jpc") returned 4
	[0075.340] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0075.340] lstrlenW (lpString=".jpe") returned 4
	[0075.340] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0075.340] lstrlenW (lpString=".jpeg") returned 5
	[0075.341] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0075.341] lstrlenW (lpString=".jpf") returned 4
	[0075.341] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0075.341] lstrlenW (lpString=".jpg") returned 4
	[0075.341] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.341] lstrlenW (lpString=".jpx") returned 4
	[0075.341] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0075.341] lstrlenW (lpString=".js") returned 3
	[0075.342] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0075.342] lstrlenW (lpString=".jsf") returned 4
	[0075.342] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0075.342] lstrlenW (lpString=".json") returned 5
	[0075.342] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0075.342] lstrlenW (lpString=".jsp") returned 4
	[0075.342] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0075.342] lstrlenW (lpString=".kdc") returned 4
	[0075.343] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0075.343] lstrlenW (lpString=".kmz") returned 4
	[0075.343] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0075.343] lstrlenW (lpString=".kwm") returned 4
	[0075.343] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0075.343] lstrlenW (lpString=".lasso") returned 6
	[0075.343] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0075.343] lstrlenW (lpString=".lbi") returned 4
	[0075.344] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0075.344] lstrlenW (lpString=".lgf") returned 4
	[0075.344] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0075.344] lstrlenW (lpString=".lgp") returned 4
	[0075.344] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0075.344] lstrlenW (lpString=".log") returned 4
	[0075.344] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0075.344] lstrlenW (lpString=".m1v") returned 4
	[0075.344] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0075.345] lstrlenW (lpString=".m4a") returned 4
	[0075.345] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0075.345] lstrlenW (lpString=".m4v") returned 4
	[0075.345] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0075.345] lstrlenW (lpString=".max") returned 4
	[0075.345] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0075.345] lstrlenW (lpString=".md") returned 3
	[0075.345] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0075.345] lstrlenW (lpString=".mda") returned 4
	[0075.346] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0075.346] lstrlenW (lpString=".mdb") returned 4
	[0075.346] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0075.346] lstrlenW (lpString=".mde") returned 4
	[0075.346] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0075.346] lstrlenW (lpString=".mdf") returned 4
	[0075.346] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0075.346] lstrlenW (lpString=".mdw") returned 4
	[0075.347] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0075.347] lstrlenW (lpString=".mef") returned 4
	[0075.347] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0075.347] lstrlenW (lpString=".mft") returned 4
	[0075.347] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0075.347] lstrlenW (lpString=".mfw") returned 4
	[0075.347] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0075.347] lstrlenW (lpString=".mht") returned 4
	[0075.348] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0075.348] lstrlenW (lpString=".mhtml") returned 6
	[0075.348] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0075.348] lstrlenW (lpString=".mka") returned 4
	[0075.348] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0075.349] lstrlenW (lpString=".mkidx") returned 6
	[0075.349] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0075.349] lstrlenW (lpString=".mkv") returned 4
	[0075.349] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0075.349] lstrlenW (lpString=".mos") returned 4
	[0075.349] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0075.349] lstrlenW (lpString=".mov") returned 4
	[0075.350] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0075.350] lstrlenW (lpString=".mp3") returned 4
	[0075.350] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0075.350] lstrlenW (lpString=".mp4") returned 4
	[0075.350] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0075.350] lstrlenW (lpString=".mpeg") returned 5
	[0075.350] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0075.350] lstrlenW (lpString=".mpg") returned 4
	[0075.350] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0075.351] lstrlenW (lpString=".mpv") returned 4
	[0075.351] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0075.351] lstrlenW (lpString=".mrw") returned 4
	[0075.351] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0075.351] lstrlenW (lpString=".msg") returned 4
	[0075.351] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0075.351] lstrlenW (lpString=".mxl") returned 4
	[0075.351] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0075.352] lstrlenW (lpString=".myd") returned 4
	[0075.352] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0075.352] lstrlenW (lpString=".myi") returned 4
	[0075.352] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0075.352] lstrlenW (lpString=".nef") returned 4
	[0075.352] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0075.352] lstrlenW (lpString=".nrw") returned 4
	[0075.352] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0075.353] lstrlenW (lpString=".obj") returned 4
	[0075.353] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0075.353] lstrlenW (lpString=".odb") returned 4
	[0075.353] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0075.353] lstrlenW (lpString=".odc") returned 4
	[0075.353] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0075.354] lstrlenW (lpString=".odm") returned 4
	[0075.354] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0075.354] lstrlenW (lpString=".odp") returned 4
	[0075.354] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0075.354] lstrlenW (lpString=".ods") returned 4
	[0075.354] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0075.354] lstrlenW (lpString=".oft") returned 4
	[0075.355] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0075.355] lstrlenW (lpString=".one") returned 4
	[0075.355] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0075.355] lstrlenW (lpString=".onepkg") returned 7
	[0075.355] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0075.355] lstrlenW (lpString=".onetoc2") returned 8
	[0075.355] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0075.356] lstrlenW (lpString=".opt") returned 4
	[0075.356] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0075.356] lstrlenW (lpString=".oqy") returned 4
	[0075.356] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0075.356] lstrlenW (lpString=".orf") returned 4
	[0075.356] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0075.357] lstrlenW (lpString=".p12") returned 4
	[0075.357] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0075.357] lstrlenW (lpString=".p7b") returned 4
	[0075.357] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0075.357] lstrlenW (lpString=".p7c") returned 4
	[0075.357] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0075.357] lstrlenW (lpString=".pam") returned 4
	[0075.358] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0075.358] lstrlenW (lpString=".pbm") returned 4
	[0075.358] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0075.358] lstrlenW (lpString=".pct") returned 4
	[0075.358] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0075.358] lstrlenW (lpString=".pcx") returned 4
	[0075.358] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0075.359] lstrlenW (lpString=".pdd") returned 4
	[0075.359] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0075.359] lstrlenW (lpString=".pdf") returned 4
	[0075.359] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.359] lstrlenW (lpString=".pdp") returned 4
	[0075.359] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0075.359] lstrlenW (lpString=".pef") returned 4
	[0075.360] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0075.360] lstrlenW (lpString=".pem") returned 4
	[0075.360] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0075.360] lstrlenW (lpString=".pff") returned 4
	[0075.360] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0075.360] lstrlenW (lpString=".pfm") returned 4
	[0075.360] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0075.361] lstrlenW (lpString=".pfx") returned 4
	[0075.361] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0075.361] lstrlenW (lpString=".pgm") returned 4
	[0075.361] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0075.361] lstrlenW (lpString=".php") returned 4
	[0075.361] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0075.362] lstrlenW (lpString=".php3") returned 5
	[0075.362] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0075.362] lstrlenW (lpString=".php4") returned 5
	[0075.362] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0075.362] lstrlenW (lpString=".php5") returned 5
	[0075.362] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0075.362] lstrlenW (lpString=".phtml") returned 6
	[0075.363] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0075.363] lstrlenW (lpString=".pict") returned 5
	[0075.363] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0075.363] lstrlenW (lpString=".pl") returned 3
	[0075.363] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0075.363] lstrlenW (lpString=".pls") returned 4
	[0075.364] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0075.364] lstrlenW (lpString=".pm") returned 3
	[0075.647] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0075.648] lstrlenW (lpString=".png") returned 4
	[0075.648] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0075.648] lstrlenW (lpString=".pnm") returned 4
	[0075.648] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0075.648] lstrlenW (lpString=".pot") returned 4
	[0075.648] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0075.649] lstrlenW (lpString=".potm") returned 5
	[0075.649] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0075.649] lstrlenW (lpString=".potx") returned 5
	[0075.649] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0075.649] lstrlenW (lpString=".ppa") returned 4
	[0075.649] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0075.650] lstrlenW (lpString=".ppam") returned 5
	[0075.650] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0075.650] lstrlenW (lpString=".ppm") returned 4
	[0075.650] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0075.650] lstrlenW (lpString=".pps") returned 4
	[0075.650] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0075.650] lstrlenW (lpString=".ppsm") returned 5
	[0075.651] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0075.651] lstrlenW (lpString=".ppt") returned 4
	[0075.651] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.651] lstrlenW (lpString=".pptm") returned 5
	[0075.651] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0075.651] lstrlenW (lpString=".pptx") returned 5
	[0075.651] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0075.652] lstrlenW (lpString=".prn") returned 4
	[0075.652] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0075.652] lstrlenW (lpString=".ps") returned 3
	[0075.652] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0075.652] lstrlenW (lpString=".psb") returned 4
	[0075.652] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0075.652] lstrlenW (lpString=".psd") returned 4
	[0075.653] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0075.653] lstrlenW (lpString=".pst") returned 4
	[0075.653] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0075.653] lstrlenW (lpString=".ptx") returned 4
	[0075.653] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0075.653] lstrlenW (lpString=".pub") returned 4
	[0075.654] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0075.654] lstrlenW (lpString=".pwm") returned 4
	[0075.654] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0075.654] lstrlenW (lpString=".pxr") returned 4
	[0075.654] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0075.654] lstrlenW (lpString=".py") returned 3
	[0075.654] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0075.655] lstrlenW (lpString=".qt") returned 3
	[0075.655] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0075.655] lstrlenW (lpString=".r3d") returned 4
	[0075.655] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0075.655] lstrlenW (lpString=".raf") returned 4
	[0075.655] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0075.656] lstrlenW (lpString=".rar") returned 4
	[0075.656] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.656] lstrlenW (lpString=".raw") returned 4
	[0075.656] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0075.656] lstrcmpiW (lpString1=".rdf", lpString2=".mui") returned 1
	[0075.657] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0075.657] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0075.658] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0075.658] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0075.658] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0075.659] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0075.770] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.771] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.771] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.771] lstrlenW (lpString=".1cd") returned 4
	[0075.771] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.772] lstrlenW (lpString=".3ds") returned 4
	[0075.772] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0075.772] lstrlenW (lpString=".3fr") returned 4
	[0075.772] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0075.772] lstrlenW (lpString=".3g2") returned 4
	[0075.772] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0075.773] lstrlenW (lpString=".3gp") returned 4
	[0075.773] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0075.773] lstrlenW (lpString=".7z") returned 3
	[0075.773] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.773] lstrlenW (lpString=".accda") returned 6
	[0075.773] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0075.774] lstrlenW (lpString=".accdb") returned 6
	[0075.774] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0075.774] lstrlenW (lpString=".accdc") returned 6
	[0075.774] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0075.774] lstrlenW (lpString=".accde") returned 6
	[0075.774] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0075.775] lstrlenW (lpString=".accdt") returned 6
	[0075.775] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0075.775] lstrlenW (lpString=".accdw") returned 6
	[0075.775] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0075.775] lstrlenW (lpString=".adb") returned 4
	[0075.776] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0075.776] lstrlenW (lpString=".adp") returned 4
	[0075.776] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0075.776] lstrlenW (lpString=".ai") returned 3
	[0075.776] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0075.777] lstrlenW (lpString=".ai3") returned 4
	[0075.777] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0075.777] lstrlenW (lpString=".ai4") returned 4
	[0075.777] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0075.777] lstrlenW (lpString=".ai5") returned 4
	[0075.777] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0075.778] lstrlenW (lpString=".ai6") returned 4
	[0075.778] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0075.778] lstrlenW (lpString=".ai7") returned 4
	[0075.778] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0075.778] lstrlenW (lpString=".ai8") returned 4
	[0075.779] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0075.779] lstrlenW (lpString=".anim") returned 5
	[0075.779] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0075.779] lstrlenW (lpString=".arw") returned 4
	[0075.779] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0075.779] lstrlenW (lpString=".as") returned 3
	[0075.780] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0075.780] lstrlenW (lpString=".asa") returned 4
	[0075.780] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0075.780] lstrlenW (lpString=".asc") returned 4
	[0075.780] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0075.781] lstrlenW (lpString=".ascx") returned 5
	[0075.781] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0075.781] lstrlenW (lpString=".asm") returned 4
	[0075.781] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0075.781] lstrlenW (lpString=".asmx") returned 5
	[0075.781] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0075.781] lstrlenW (lpString=".asp") returned 4
	[0075.782] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0075.782] lstrlenW (lpString=".aspx") returned 5
	[0075.782] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0075.782] lstrlenW (lpString=".asr") returned 4
	[0075.782] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0075.782] lstrlenW (lpString=".asx") returned 4
	[0075.783] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0075.783] lstrlenW (lpString=".avi") returned 4
	[0075.783] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0075.783] lstrlenW (lpString=".avs") returned 4
	[0075.783] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0075.783] lstrlenW (lpString=".backup") returned 7
	[0075.784] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0075.784] lstrlenW (lpString=".bak") returned 4
	[0075.784] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0075.784] lstrlenW (lpString=".bay") returned 4
	[0075.784] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0075.784] lstrlenW (lpString=".bd") returned 3
	[0075.785] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0075.785] lstrlenW (lpString=".bin") returned 4
	[0075.785] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0075.785] lstrlenW (lpString=".bmp") returned 4
	[0075.785] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0075.786] lstrlenW (lpString=".bz2") returned 4
	[0075.786] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.786] lstrlenW (lpString=".c") returned 2
	[0075.786] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0075.786] lstrlenW (lpString=".cdr") returned 4
	[0075.786] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0075.787] lstrlenW (lpString=".cer") returned 4
	[0075.787] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0075.787] lstrlenW (lpString=".cf") returned 3
	[0075.787] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0075.787] lstrlenW (lpString=".cfc") returned 4
	[0075.787] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0075.788] lstrlenW (lpString=".cfm") returned 4
	[0075.788] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0075.788] lstrlenW (lpString=".cfml") returned 5
	[0075.788] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0075.788] lstrlenW (lpString=".cfu") returned 4
	[0075.789] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0075.789] lstrlenW (lpString=".chm") returned 4
	[0075.789] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0075.789] lstrlenW (lpString=".cin") returned 4
	[0075.789] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0075.789] lstrlenW (lpString=".class") returned 6
	[0075.790] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0075.790] lstrlenW (lpString=".clx") returned 4
	[0075.790] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0075.790] lstrlenW (lpString=".config") returned 7
	[0075.790] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0075.790] lstrlenW (lpString=".cpp") returned 4
	[0075.791] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0075.791] lstrlenW (lpString=".cr2") returned 4
	[0075.791] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0075.791] lstrlenW (lpString=".crt") returned 4
	[0075.791] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0075.791] lstrlenW (lpString=".crw") returned 4
	[0075.792] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0075.792] lstrlenW (lpString=".cs") returned 3
	[0075.792] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0075.792] lstrlenW (lpString=".css") returned 4
	[0075.792] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0075.792] lstrlenW (lpString=".csv") returned 4
	[0075.792] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0075.793] lstrlenW (lpString=".cub") returned 4
	[0075.793] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0075.793] lstrlenW (lpString=".dae") returned 4
	[0075.793] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0075.793] lstrlenW (lpString=".dat") returned 4
	[0075.793] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0075.794] lstrlenW (lpString=".db") returned 3
	[0075.794] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0075.794] lstrlenW (lpString=".dbf") returned 4
	[0075.794] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.794] lstrlenW (lpString=".dbx") returned 4
	[0075.794] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0075.794] lstrlenW (lpString=".dc3") returned 4
	[0075.795] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0075.795] lstrlenW (lpString=".dcm") returned 4
	[0075.795] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0075.795] lstrlenW (lpString=".dcr") returned 4
	[0075.795] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0075.795] lstrlenW (lpString=".der") returned 4
	[0075.796] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0075.796] lstrlenW (lpString=".dib") returned 4
	[0075.796] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0075.796] lstrlenW (lpString=".dic") returned 4
	[0075.796] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0075.796] lstrlenW (lpString=".dif") returned 4
	[0075.797] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0075.797] lstrlenW (lpString=".divx") returned 5
	[0075.797] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0075.797] lstrlenW (lpString=".djvu") returned 5
	[0075.797] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0075.797] lstrlenW (lpString=".dng") returned 4
	[0075.798] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0075.798] lstrlenW (lpString=".doc") returned 4
	[0075.798] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.798] lstrlenW (lpString=".docm") returned 5
	[0075.798] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0075.798] lstrlenW (lpString=".docx") returned 5
	[0075.798] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.799] lstrlenW (lpString=".dot") returned 4
	[0075.799] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0075.799] lstrlenW (lpString=".dotm") returned 5
	[0075.799] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0075.799] lstrlenW (lpString=".dotx") returned 5
	[0075.799] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0075.800] lstrlenW (lpString=".dpx") returned 4
	[0075.800] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0075.800] lstrlenW (lpString=".dqy") returned 4
	[0075.800] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0075.800] lstrlenW (lpString=".dsn") returned 4
	[0075.800] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0075.801] lstrlenW (lpString=".dt") returned 3
	[0075.981] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0075.981] lstrlenW (lpString=".dtd") returned 4
	[0075.981] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0075.981] lstrlenW (lpString=".dwg") returned 4
	[0075.981] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0075.981] lstrlenW (lpString=".dwt") returned 4
	[0075.982] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0075.982] lstrlenW (lpString=".dx") returned 3
	[0075.982] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0075.982] lstrlenW (lpString=".dxf") returned 4
	[0075.982] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0075.982] lstrlenW (lpString=".edml") returned 5
	[0075.982] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0075.983] lstrlenW (lpString=".efd") returned 4
	[0075.983] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0075.983] lstrlenW (lpString=".elf") returned 4
	[0075.983] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0075.983] lstrlenW (lpString=".emf") returned 4
	[0075.983] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0075.983] lstrlenW (lpString=".emz") returned 4
	[0075.984] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0075.984] lstrlenW (lpString=".epf") returned 4
	[0075.984] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0075.984] lstrlenW (lpString=".eps") returned 4
	[0075.984] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0075.984] lstrlenW (lpString=".epsf") returned 5
	[0075.985] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0075.985] lstrlenW (lpString=".epsp") returned 5
	[0075.985] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0075.985] lstrlenW (lpString=".erf") returned 4
	[0075.985] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0075.985] lstrlenW (lpString=".exr") returned 4
	[0075.986] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0075.986] lstrlenW (lpString=".f4v") returned 4
	[0075.986] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0075.986] lstrlenW (lpString=".fido") returned 5
	[0075.986] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0075.986] lstrlenW (lpString=".flm") returned 4
	[0075.987] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0075.987] lstrlenW (lpString=".flv") returned 4
	[0075.987] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0075.987] lstrlenW (lpString=".frm") returned 4
	[0075.987] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0075.987] lstrlenW (lpString=".fxg") returned 4
	[0075.988] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0075.988] lstrlenW (lpString=".geo") returned 4
	[0075.988] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0075.989] lstrlenW (lpString=".gif") returned 4
	[0075.989] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0075.989] lstrlenW (lpString=".grs") returned 4
	[0075.989] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0075.989] lstrlenW (lpString=".gz") returned 3
	[0075.989] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0075.990] lstrlenW (lpString=".h") returned 2
	[0075.990] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0075.990] lstrlenW (lpString=".hdr") returned 4
	[0075.990] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0075.990] lstrlenW (lpString=".hpp") returned 4
	[0075.990] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0075.990] lstrlenW (lpString=".hta") returned 4
	[0075.991] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0075.991] lstrlenW (lpString=".htc") returned 4
	[0075.991] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0075.991] lstrlenW (lpString=".htm") returned 4
	[0075.991] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0075.991] lstrlenW (lpString=".html") returned 5
	[0075.992] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0075.992] lstrlenW (lpString=".icb") returned 4
	[0075.992] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0075.992] lstrlenW (lpString=".ics") returned 4
	[0075.992] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0075.992] lstrlenW (lpString=".iff") returned 4
	[0075.993] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0075.993] lstrlenW (lpString=".inc") returned 4
	[0075.993] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0075.993] lstrlenW (lpString=".indd") returned 5
	[0075.993] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0075.993] lstrlenW (lpString=".ini") returned 4
	[0075.994] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0075.994] lstrlenW (lpString=".iqy") returned 4
	[0075.994] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0075.994] lstrlenW (lpString=".j2c") returned 4
	[0075.994] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0075.995] lstrlenW (lpString=".j2k") returned 4
	[0075.995] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0075.995] lstrlenW (lpString=".java") returned 5
	[0075.995] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0075.995] lstrlenW (lpString=".jp2") returned 4
	[0075.995] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0075.996] lstrlenW (lpString=".jpc") returned 4
	[0075.996] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0075.996] lstrlenW (lpString=".jpe") returned 4
	[0075.996] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0075.996] lstrlenW (lpString=".jpeg") returned 5
	[0075.996] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0075.997] lstrlenW (lpString=".jpf") returned 4
	[0075.997] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0075.997] lstrlenW (lpString=".jpg") returned 4
	[0075.997] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.997] lstrlenW (lpString=".jpx") returned 4
	[0075.997] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0075.997] lstrlenW (lpString=".js") returned 3
	[0075.998] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0075.998] lstrlenW (lpString=".jsf") returned 4
	[0075.998] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0075.998] lstrlenW (lpString=".json") returned 5
	[0075.998] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0075.998] lstrlenW (lpString=".jsp") returned 4
	[0075.999] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0075.999] lstrlenW (lpString=".kdc") returned 4
	[0075.999] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0075.999] lstrlenW (lpString=".kmz") returned 4
	[0075.999] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0076.000] lstrlenW (lpString=".kwm") returned 4
	[0076.000] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0076.000] lstrlenW (lpString=".lasso") returned 6
	[0076.000] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0076.000] lstrlenW (lpString=".lbi") returned 4
	[0076.000] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0076.000] lstrlenW (lpString=".lgf") returned 4
	[0076.001] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0076.001] lstrlenW (lpString=".lgp") returned 4
	[0076.001] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0076.001] lstrlenW (lpString=".log") returned 4
	[0076.001] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0076.001] lstrlenW (lpString=".m1v") returned 4
	[0076.002] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0076.002] lstrlenW (lpString=".m4a") returned 4
	[0076.002] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0076.002] lstrlenW (lpString=".m4v") returned 4
	[0076.002] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0076.002] lstrlenW (lpString=".max") returned 4
	[0076.003] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0076.003] lstrlenW (lpString=".md") returned 3
	[0076.003] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0076.003] lstrlenW (lpString=".mda") returned 4
	[0076.003] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0076.004] lstrlenW (lpString=".mdb") returned 4
	[0076.004] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0076.004] lstrlenW (lpString=".mde") returned 4
	[0076.004] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0076.005] lstrlenW (lpString=".mdf") returned 4
	[0076.005] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0076.005] lstrlenW (lpString=".mdw") returned 4
	[0076.005] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0076.005] lstrlenW (lpString=".mef") returned 4
	[0076.005] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0076.006] lstrlenW (lpString=".mft") returned 4
	[0076.006] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0076.006] lstrlenW (lpString=".mfw") returned 4
	[0076.006] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0076.006] lstrlenW (lpString=".mht") returned 4
	[0076.006] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0076.006] lstrlenW (lpString=".mhtml") returned 6
	[0076.007] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0076.007] lstrlenW (lpString=".mka") returned 4
	[0076.007] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0076.007] lstrlenW (lpString=".mkidx") returned 6
	[0076.007] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0076.008] lstrlenW (lpString=".mkv") returned 4
	[0076.008] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0076.008] lstrlenW (lpString=".mos") returned 4
	[0076.008] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0076.008] lstrlenW (lpString=".mov") returned 4
	[0076.008] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0076.009] lstrlenW (lpString=".mp3") returned 4
	[0076.009] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0076.009] lstrlenW (lpString=".mp4") returned 4
	[0076.009] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0076.009] lstrlenW (lpString=".mpeg") returned 5
	[0076.009] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0076.010] lstrlenW (lpString=".mpg") returned 4
	[0076.010] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0076.010] lstrlenW (lpString=".mpv") returned 4
	[0076.010] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0076.010] lstrlenW (lpString=".mrw") returned 4
	[0076.010] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0076.011] lstrlenW (lpString=".msg") returned 4
	[0076.011] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0076.011] lstrlenW (lpString=".mxl") returned 4
	[0076.011] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0076.011] lstrlenW (lpString=".myd") returned 4
	[0076.011] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0076.012] lstrlenW (lpString=".myi") returned 4
	[0076.012] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0076.012] lstrlenW (lpString=".nef") returned 4
	[0076.012] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0076.012] lstrlenW (lpString=".nrw") returned 4
	[0076.013] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0076.013] lstrlenW (lpString=".obj") returned 4
	[0076.013] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0076.013] lstrlenW (lpString=".odb") returned 4
	[0076.013] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0076.013] lstrlenW (lpString=".odc") returned 4
	[0076.014] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0076.014] lstrlenW (lpString=".odm") returned 4
	[0076.014] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0076.014] lstrlenW (lpString=".odp") returned 4
	[0076.014] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0076.015] lstrlenW (lpString=".ods") returned 4
	[0076.015] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0076.015] lstrlenW (lpString=".oft") returned 4
	[0076.015] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0076.015] lstrlenW (lpString=".one") returned 4
	[0076.015] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0076.016] lstrlenW (lpString=".onepkg") returned 7
	[0076.016] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0076.016] lstrlenW (lpString=".onetoc2") returned 8
	[0076.016] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0076.016] lstrlenW (lpString=".opt") returned 4
	[0076.016] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0076.017] lstrlenW (lpString=".oqy") returned 4
	[0076.017] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0076.017] lstrlenW (lpString=".orf") returned 4
	[0076.017] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0076.017] lstrlenW (lpString=".p12") returned 4
	[0076.017] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0076.018] lstrlenW (lpString=".p7b") returned 4
	[0076.018] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0076.018] lstrlenW (lpString=".p7c") returned 4
	[0076.018] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0076.018] lstrlenW (lpString=".pam") returned 4
	[0076.018] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0076.019] lstrlenW (lpString=".pbm") returned 4
	[0076.019] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0076.019] lstrlenW (lpString=".pct") returned 4
	[0076.414] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0076.414] lstrlenW (lpString=".pcx") returned 4
	[0076.414] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0076.414] lstrlenW (lpString=".pdd") returned 4
	[0076.414] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0076.414] lstrlenW (lpString=".pdf") returned 4
	[0076.415] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.415] lstrlenW (lpString=".pdp") returned 4
	[0076.415] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0076.415] lstrlenW (lpString=".pef") returned 4
	[0076.415] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0076.416] lstrlenW (lpString=".pem") returned 4
	[0076.416] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0076.416] lstrlenW (lpString=".pff") returned 4
	[0076.416] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0076.416] lstrlenW (lpString=".pfm") returned 4
	[0076.416] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0076.417] lstrlenW (lpString=".pfx") returned 4
	[0076.417] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0076.417] lstrlenW (lpString=".pgm") returned 4
	[0076.417] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0076.417] lstrlenW (lpString=".php") returned 4
	[0076.418] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0076.418] lstrlenW (lpString=".php3") returned 5
	[0076.418] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0076.418] lstrlenW (lpString=".php4") returned 5
	[0076.418] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0076.419] lstrlenW (lpString=".php5") returned 5
	[0076.419] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0076.419] lstrlenW (lpString=".phtml") returned 6
	[0076.419] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0076.419] lstrlenW (lpString=".pict") returned 5
	[0076.419] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0076.420] lstrlenW (lpString=".pl") returned 3
	[0076.420] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0076.420] lstrlenW (lpString=".pls") returned 4
	[0076.420] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0076.420] lstrlenW (lpString=".pm") returned 3
	[0076.420] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0076.421] lstrlenW (lpString=".png") returned 4
	[0076.421] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0076.421] lstrlenW (lpString=".pnm") returned 4
	[0076.421] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0076.421] lstrlenW (lpString=".pot") returned 4
	[0076.422] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0076.422] lstrlenW (lpString=".potm") returned 5
	[0076.422] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0076.422] lstrlenW (lpString=".potx") returned 5
	[0076.422] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0076.422] lstrlenW (lpString=".ppa") returned 4
	[0076.422] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0076.423] lstrlenW (lpString=".ppam") returned 5
	[0076.423] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0076.423] lstrlenW (lpString=".ppm") returned 4
	[0076.423] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0076.423] lstrlenW (lpString=".pps") returned 4
	[0076.424] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0076.425] lstrlenW (lpString=".ppsm") returned 5
	[0076.425] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0076.425] lstrlenW (lpString=".ppt") returned 4
	[0076.426] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.426] lstrlenW (lpString=".pptm") returned 5
	[0076.426] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0076.426] lstrlenW (lpString=".pptx") returned 5
	[0076.426] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0076.426] lstrlenW (lpString=".prn") returned 4
	[0076.427] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0076.427] lstrlenW (lpString=".ps") returned 3
	[0076.427] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0076.427] lstrlenW (lpString=".psb") returned 4
	[0076.427] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0076.428] lstrlenW (lpString=".psd") returned 4
	[0076.428] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0076.428] lstrlenW (lpString=".pst") returned 4
	[0076.428] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0076.428] lstrlenW (lpString=".ptx") returned 4
	[0076.428] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0076.429] lstrlenW (lpString=".pub") returned 4
	[0076.429] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0076.429] lstrlenW (lpString=".pwm") returned 4
	[0076.429] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0076.429] lstrlenW (lpString=".pxr") returned 4
	[0076.429] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0076.430] lstrlenW (lpString=".py") returned 3
	[0076.430] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0076.430] lstrlenW (lpString=".qt") returned 3
	[0076.430] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0076.430] lstrlenW (lpString=".r3d") returned 4
	[0076.431] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0076.431] lstrlenW (lpString=".raf") returned 4
	[0076.431] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0076.431] lstrlenW (lpString=".rar") returned 4
	[0076.431] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.431] lstrlenW (lpString=".raw") returned 4
	[0076.432] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0076.435] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0076.435] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.435] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0076.436] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.436] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0076.437] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.437] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.438] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0076.438] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.439] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0076.439] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.439] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0076.550] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.551] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.551] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0076.552] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.552] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0076.552] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.553] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0076.553] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.553] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.554] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0076.554] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.554] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0076.555] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.555] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0076.800] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.800] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.801] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0076.801] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.801] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0076.802] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.802] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0076.803] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.803] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.804] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0076.804] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.804] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0076.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.805] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.924] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.924] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.925] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.925] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.925] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0076.926] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.926] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.927] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.927] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.927] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.928] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.928] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0076.928] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.929] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.929] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.929] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.930] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.930] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.930] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0076.931] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.931] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.931] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.931] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.932] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.932] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x2e0000) returned 1
	[0076.932] FindNextFileW (in: hFindFile=0x33a978, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0076.933] FindClose (in: hFindFile=0x33a978 | out: hFindFile=0x33a978) returned 1
	[0076.933] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35f0060 | out: hHeap=0x2e0000) returned 1
	[0076.933] FindNextFileW (in: hFindFile=0x3315f8, lpFindFileData=0x2ecfd00 | out: lpFindFileData=0x2ecfd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0076.934] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x35f0060
	[0076.934] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33a950
	[0076.934] FindNextFileW (in: hFindFile=0x33a950, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.934] FindNextFileW (in: hFindFile=0x33a950, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0076.934] FindClose (in: hFindFile=0x33a950 | out: hFindFile=0x33a950) returned 1
	[0076.935] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35f0060 | out: hHeap=0x2e0000) returned 1
	[0076.935] FindNextFileW (in: hFindFile=0x3315f8, lpFindFileData=0x2ecfd00 | out: lpFindFileData=0x2ecfd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0076.935] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x35f0060
	[0076.936] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="5\x16")) returned 0xffffffff
	[0076.936] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35f0060 | out: hHeap=0x2e0000) returned 1
	[0076.936] FindNextFileW (in: hFindFile=0x3315f8, lpFindFileData=0x2ecfd00 | out: lpFindFileData=0x2ecfd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0076.937] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x35f0060
	[0076.937] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33a950
	[0076.937] FindNextFileW (in: hFindFile=0x33a950, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.937] FindNextFileW (in: hFindFile=0x33a950, lpFindFileData=0x2ecfa84 | out: lpFindFileData=0x2ecfa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0076.938] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3e90048
	[0076.938] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0077.066] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.096] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x2ecf808 | out: lpFindFileData=0x2ecf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1
	[0078.815] lstrcmpiW (lpString1=".1cd", lpString2=".msi") 
	[0078.815] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0078.815] lstrlenW (lpString=".3ds") returned 4
	[0078.815] lstrcmpiW (lpString1=".3ds", lpString2=".msi") returned -1
	[0078.816] lstrlenW (lpString=".3fr") returned 4
	[0078.816] lstrcmpiW (lpString1=".3fr", lpString2=".msi") returned -1
	[0078.816] lstrlenW (lpString=".3g2") returned 4
	[0078.816] lstrcmpiW (lpString1=".3g2", lpString2=".msi") returned -1
	[0078.816] lstrlenW (lpString=".3gp") returned 4
	[0078.816] lstrcmpiW (lpString1=".3gp", lpString2=".msi") returned -1
	[0078.816] lstrlenW (lpString=".7z") returned 3
	[0078.817] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0078.817] lstrlenW (lpString=".accda") returned 6
	[0078.817] lstrcmpiW (lpString1=".accda", lpString2="WW.msi") returned -1
	[0078.817] lstrlenW (lpString=".accdb") returned 6
	[0078.817] lstrcmpiW (lpString1=".accdb", lpString2="WW.msi") returned -1
	[0078.817] lstrlenW (lpString=".accdc") returned 6
	[0078.817] lstrcmpiW (lpString1=".accdc", lpString2="WW.msi") returned -1
	[0078.818] lstrlenW (lpString=".accde") returned 6
	[0078.818] lstrcmpiW (lpString1=".accde", lpString2="WW.msi") returned -1
	[0078.818] lstrlenW (lpString=".accdt") returned 6
	[0078.818] lstrcmpiW (lpString1=".accdt", lpString2="WW.msi") returned -1
	[0078.818] lstrlenW (lpString=".accdw") returned 6
	[0078.870] lstrcmpiW (lpString1=".accdw", lpString2="WW.msi") returned -1
	[0078.870] lstrlenW (lpString=".adb") returned 4
	[0078.870] lstrcmpiW (lpString1=".adb", lpString2=".msi") returned -1
	[0078.870] lstrlenW (lpString=".adp") returned 4
	[0078.870] lstrcmpiW (lpString1=".adp", lpString2=".msi") returned -1
	[0078.870] lstrlenW (lpString=".ai") returned 3
	[0078.871] lstrcmpiW (lpString1=".ai", lpString2="msi") returned -1
	[0078.871] lstrlenW (lpString=".ai3") returned 4
	[0078.871] lstrcmpiW (lpString1=".ai3", lpString2=".msi") returned -1
	[0078.871] lstrlenW (lpString=".ai4") returned 4
	[0078.871] lstrcmpiW (lpString1=".ai4", lpString2=".msi") returned -1
	[0078.871] lstrlenW (lpString=".ai5") returned 4
	[0078.871] lstrcmpiW (lpString1=".ai5", lpString2=".msi") returned -1
	[0078.872] lstrlenW (lpString=".ai6") returned 4
	[0078.872] lstrcmpiW (lpString1=".ai6", lpString2=".msi") returned -1
	[0078.872] lstrlenW (lpString=".ai7") returned 4
	[0078.872] lstrcmpiW (lpString1=".ai7", lpString2=".msi") returned -1
	[0078.872] lstrlenW (lpString=".ai8") returned 4
	[0078.872] lstrcmpiW (lpString1=".ai8", lpString2=".msi") returned -1
	[0078.872] lstrlenW (lpString=".anim") returned 5
	[0078.873] lstrcmpiW (lpString1=".anim", lpString2="W.msi") returned -1
	[0078.873] lstrlenW (lpString=".arw") returned 4
	[0078.873] lstrcmpiW (lpString1=".arw", lpString2=".msi") returned -1
	[0078.873] lstrlenW (lpString=".as") returned 3
	[0078.873] lstrcmpiW (lpString1=".as", lpString2="msi") returned -1
	[0078.873] lstrlenW (lpString=".asa") returned 4
	[0078.873] lstrcmpiW (lpString1=".asa", lpString2=".msi") returned -1
	[0078.874] lstrlenW (lpString=".asc") returned 4
	[0078.874] lstrcmpiW (lpString1=".asc", lpString2=".msi") returned -1
	[0078.874] lstrlenW (lpString=".ascx") returned 5
	[0078.874] lstrcmpiW (lpString1=".ascx", lpString2="W.msi") returned -1
	[0078.874] lstrlenW (lpString=".asm") returned 4
	[0078.874] lstrcmpiW (lpString1=".asm", lpString2=".msi") returned -1
	[0078.875] lstrlenW (lpString=".asmx") returned 5
	[0078.875] lstrcmpiW (lpString1=".asmx", lpString2="W.msi") returned -1
	[0078.875] lstrlenW (lpString=".asp") returned 4
	[0078.875] lstrcmpiW (lpString1=".asp", lpString2=".msi") returned -1
	[0078.875] lstrlenW (lpString=".aspx") returned 5
	[0078.875] lstrcmpiW (lpString1=".aspx", lpString2="W.msi") returned -1
	[0078.876] lstrlenW (lpString=".asr") returned 4
	[0078.876] lstrcmpiW (lpString1=".asr", lpString2=".msi") returned -1
	[0078.876] lstrlenW (lpString=".asx") returned 4
	[0078.876] lstrcmpiW (lpString1=".asx", lpString2=".msi") returned -1
	[0078.876] lstrlenW (lpString=".avi") returned 4
	[0078.876] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1
	[0078.876] lstrlenW (lpString=".avs") returned 4
	[0078.877] lstrcmpiW (lpString1=".avs", lpString2=".msi") returned -1
	[0078.877] lstrlenW (lpString=".backup") returned 7
	[0078.877] lstrcmpiW (lpString1=".backup", lpString2="2WW.msi") returned -1
	[0078.877] lstrlenW (lpString=".bak") returned 4
	[0078.877] lstrcmpiW (lpString1=".bak", lpString2=".msi") returned -1
	[0078.877] lstrlenW (lpString=".bay") returned 4
	[0078.878] lstrcmpiW (lpString1=".bay", lpString2=".msi") returned -1
	[0078.878] lstrlenW (lpString=".bd") returned 3
	[0078.878] lstrcmpiW (lpString1=".bd", lpString2="msi") returned -1
	[0078.878] lstrlenW (lpString=".bin") returned 4
	[0078.878] lstrcmpiW (lpString1=".bin", lpString2=".msi") returned -1
	[0078.878] lstrlenW (lpString=".bmp") returned 4
	[0078.878] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1
	[0078.879] lstrlenW (lpString=".bz2") returned 4
	[0078.879] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0078.879] lstrlenW (lpString=".c") returned 2
	[0078.879] lstrcmpiW (lpString1=".c", lpString2="si") returned -1
	[0078.879] lstrlenW (lpString=".cdr") returned 4
	[0078.879] lstrcmpiW (lpString1=".cdr", lpString2=".msi") returned -1
	[0078.880] lstrlenW (lpString=".cer") returned 4
	[0078.880] lstrcmpiW (lpString1=".cer", lpString2=".msi") returned -1
	[0078.880] lstrlenW (lpString=".cf") returned 3
	[0078.880] lstrcmpiW (lpString1=".cf", lpString2="msi") returned -1
	[0078.880] lstrlenW (lpString=".cfc") returned 4
	[0078.880] lstrcmpiW (lpString1=".cfc", lpString2=".msi") returned -1
	[0078.881] lstrlenW (lpString=".cfm") returned 4
	[0078.881] lstrcmpiW (lpString1=".cfm", lpString2=".msi") returned -1
	[0078.881] lstrlenW (lpString=".cfml") returned 5
	[0078.881] lstrcmpiW (lpString1=".cfml", lpString2="W.msi") returned -1
	[0078.881] lstrlenW (lpString=".cfu") returned 4
	[0078.881] lstrcmpiW (lpString1=".cfu", lpString2=".msi") returned -1
	[0078.881] lstrlenW (lpString=".chm") returned 4
	[0078.882] lstrcmpiW (lpString1=".chm", lpString2=".msi") returned -1
	[0078.882] lstrlenW (lpString=".cin") returned 4
	[0078.882] lstrcmpiW (lpString1=".cin", lpString2=".msi") returned -1
	[0078.882] lstrlenW (lpString=".class") returned 6
	[0078.882] lstrcmpiW (lpString1=".class", lpString2="WW.msi") returned -1
	[0078.882] lstrlenW (lpString=".clx") returned 4
	[0078.882] lstrcmpiW (lpString1=".clx", lpString2=".msi") returned -1
	[0078.883] lstrlenW (lpString=".config") returned 7
	[0078.883] lstrcmpiW (lpString1=".config", lpString2="2WW.msi") returned -1
	[0078.883] lstrlenW (lpString=".cpp") returned 4
	[0078.883] lstrcmpiW (lpString1=".cpp", lpString2=".msi") returned -1
	[0078.883] lstrlenW (lpString=".cr2") returned 4
	[0078.883] lstrcmpiW (lpString1=".cr2", lpString2=".msi") returned -1
	[0078.883] lstrlenW (lpString=".crt") returned 4
	[0078.883] lstrcmpiW (lpString1=".crt", lpString2=".msi") returned -1
	[0078.884] lstrlenW (lpString=".crw") returned 4
	[0078.884] lstrcmpiW (lpString1=".crw", lpString2=".msi") returned -1
	[0078.884] lstrlenW (lpString=".cs") returned 3
	[0078.884] lstrcmpiW (lpString1=".cs", lpString2="msi") returned -1
	[0078.884] lstrlenW (lpString=".css") returned 4
	[0078.884] lstrcmpiW (lpString1=".css", lpString2=".msi") returned -1
	[0078.884] lstrlenW (lpString=".csv") returned 4
	[0078.884] lstrcmpiW (lpString1=".csv", lpString2=".msi") returned -1
	[0078.884] lstrlenW (lpString=".cub") returned 4
	[0078.885] lstrcmpiW (lpString1=".cub", lpString2=".msi") returned -1
	[0078.885] lstrlenW (lpString=".dae") returned 4
	[0078.885] lstrcmpiW (lpString1=".dae", lpString2=".msi") returned -1
	[0078.885] lstrlenW (lpString=".dat") returned 4
	[0078.885] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1
	[0078.885] lstrlenW (lpString=".db") returned 3
	[0078.885] lstrcmpiW (lpString1=".db", lpString2="msi") returned -1
	[0078.885] lstrlenW (lpString=".dbf") returned 4
	[0078.886] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0078.886] lstrlenW (lpString=".dbx") returned 4
	[0078.886] lstrcmpiW (lpString1=".dbx", lpString2=".msi") returned -1
	[0078.886] lstrlenW (lpString=".dc3") returned 4
	[0078.886] lstrcmpiW (lpString1=".dc3", lpString2=".msi") returned -1
	[0078.886] lstrlenW (lpString=".dcm") returned 4
	[0078.886] lstrcmpiW (lpString1=".dcm", lpString2=".msi") returned -1
	[0078.887] lstrlenW (lpString=".dcr") returned 4
	[0078.887] lstrcmpiW (lpString1=".dcr", lpString2=".msi") returned -1
	[0078.887] lstrlenW (lpString=".der") returned 4
	[0078.887] lstrcmpiW (lpString1=".der", lpString2=".msi") returned -1
	[0078.887] lstrlenW (lpString=".dib") returned 4
	[0078.887] lstrcmpiW (lpString1=".dib", lpString2=".msi") returned -1
	[0078.887] lstrlenW (lpString=".dic") returned 4
	[0078.887] lstrcmpiW (lpString1=".dic", lpString2=".msi") returned -1
	[0078.887] lstrlenW (lpString=".dif") returned 4
	[0078.888] lstrcmpiW (lpString1=".dif", lpString2=".msi") returned -1
	[0078.888] lstrlenW (lpString=".divx") returned 5
	[0078.888] lstrcmpiW (lpString1=".divx", lpString2="W.msi") returned -1
	[0078.888] lstrlenW (lpString=".djvu") returned 5
	[0078.888] lstrcmpiW (lpString1=".djvu", lpString2="W.msi") returned -1
	[0078.888] lstrlenW (lpString=".dng") returned 4
	[0078.888] lstrcmpiW (lpString1=".dng", lpString2=".msi") returned -1
	[0078.889] lstrlenW (lpString=".doc") returned 4
	[0078.889] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0078.889] lstrlenW (lpString=".docm") returned 5
	[0078.889] lstrcmpiW (lpString1=".docm", lpString2="W.msi") returned -1
	[0078.889] lstrlenW (lpString=".docx") returned 5
	[0078.889] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0078.889] lstrlenW (lpString=".dot") returned 4
	[0078.889] lstrcmpiW (lpString1=".dot", lpString2=".msi") returned -1
	[0078.890] lstrlenW (lpString=".dotm") returned 5
	[0078.890] lstrcmpiW (lpString1=".dotm", lpString2="W.msi") returned -1
	[0078.890] lstrlenW (lpString=".dotx") returned 5
	[0078.890] lstrcmpiW (lpString1=".dotx", lpString2="W.msi") returned -1
	[0078.890] lstrlenW (lpString=".dpx") returned 4
	[0078.890] lstrcmpiW (lpString1=".dpx", lpString2=".msi") returned -1
	[0078.890] lstrlenW (lpString=".dqy") returned 4
	[0078.890] lstrcmpiW (lpString1=".dqy", lpString2=".msi") returned -1
	[0078.891] lstrlenW (lpString=".dsn") returned 4
	[0078.891] lstrcmpiW (lpString1=".dsn", lpString2=".msi") returned -1
	[0078.891] lstrlenW (lpString=".dt") returned 3
	[0078.891] lstrcmpiW (lpString1=".dt", lpString2="msi") returned -1
	[0078.891] lstrlenW (lpString=".dtd") returned 4
	[0078.891] lstrcmpiW (lpString1=".dtd", lpString2=".msi") returned -1
	[0078.891] lstrlenW (lpString=".dwg") returned 4
	[0078.891] lstrcmpiW (lpString1=".dwg", lpString2=".msi") returned -1
	[0078.892] lstrlenW (lpString=".dwt") returned 4
	[0078.892] lstrcmpiW (lpString1=".dwt", lpString2=".msi") returned -1
	[0078.892] lstrlenW (lpString=".dx") returned 3
	[0078.892] lstrcmpiW (lpString1=".dx", lpString2="msi") returned -1
	[0078.892] lstrlenW (lpString=".dxf") returned 4
	[0078.892] lstrcmpiW (lpString1=".dxf", lpString2=".msi") returned -1
	[0078.892] lstrlenW (lpString=".edml") returned 5
	[0078.893] lstrcmpiW (lpString1=".edml", lpString2="W.msi") returned -1
	[0078.893] lstrlenW (lpString=".efd") returned 4
	[0078.893] lstrcmpiW (lpString1=".efd", lpString2=".msi") returned -1
	[0078.893] lstrlenW (lpString=".elf") returned 4
	[0078.893] lstrcmpiW (lpString1=".elf", lpString2=".msi") returned -1
	[0078.893] lstrlenW (lpString=".emf") returned 4
	[0078.893] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1
	[0078.894] lstrlenW (lpString=".emz") returned 4
	[0078.894] lstrcmpiW (lpString1=".emz", lpString2=".msi") returned -1
	[0078.894] lstrlenW (lpString=".epf") returned 4
	[0078.894] lstrcmpiW (lpString1=".epf", lpString2=".msi") returned -1
	[0078.894] lstrlenW (lpString=".eps") returned 4
	[0078.894] lstrcmpiW (lpString1=".eps", lpString2=".msi") returned -1
	[0078.894] lstrlenW (lpString=".epsf") returned 5
	[0078.894] lstrcmpiW (lpString1=".epsf", lpString2="W.msi") returned -1
	[0078.895] lstrlenW (lpString=".epsp") returned 5
	[0078.895] lstrcmpiW (lpString1=".epsp", lpString2="W.msi") returned -1
	[0078.895] lstrlenW (lpString=".erf") returned 4
	[0078.895] lstrcmpiW (lpString1=".erf", lpString2=".msi") returned -1
	[0078.895] lstrlenW (lpString=".exr") returned 4
	[0078.895] lstrcmpiW (lpString1=".exr", lpString2=".msi") returned -1
	[0078.895] lstrlenW (lpString=".f4v") returned 4
	[0078.896] lstrcmpiW (lpString1=".f4v", lpString2=".msi") returned -1
	[0078.896] lstrlenW (lpString=".fido") returned 5
	[0078.896] lstrcmpiW (lpString1=".fido", lpString2="W.msi") returned -1
	[0078.896] lstrlenW (lpString=".flm") returned 4
	[0078.896] lstrcmpiW (lpString1=".flm", lpString2=".msi") returned -1
	[0078.896] lstrlenW (lpString=".flv") returned 4
	[0078.897] lstrcmpiW (lpString1=".flv", lpString2=".msi") returned -1
	[0078.897] lstrlenW (lpString=".frm") returned 4
	[0078.897] lstrcmpiW (lpString1=".frm", lpString2=".msi") returned -1
	[0078.897] lstrlenW (lpString=".fxg") returned 4
	[0078.897] lstrcmpiW (lpString1=".fxg", lpString2=".msi") returned -1
	[0078.897] lstrlenW (lpString=".geo") returned 4
	[0078.897] lstrcmpiW (lpString1=".geo", lpString2=".msi") returned -1
	[0078.897] lstrlenW (lpString=".gif") returned 4
	[0078.898] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1
	[0078.898] lstrlenW (lpString=".grs") returned 4
	[0078.898] lstrcmpiW (lpString1=".grs", lpString2=".msi") returned -1
	[0078.898] lstrlenW (lpString=".gz") returned 3
	[0078.898] lstrcmpiW (lpString1=".gz", lpString2="msi") returned -1
	[0078.898] lstrlenW (lpString=".h") returned 2
	[0078.898] lstrcmpiW (lpString1=".h", lpString2="si") returned -1
	[0078.899] lstrlenW (lpString=".hdr") returned 4
	[0078.899] lstrcmpiW (lpString1=".hdr", lpString2=".msi") returned -1
	[0078.899] lstrlenW (lpString=".hpp") returned 4
	[0078.899] lstrcmpiW (lpString1=".hpp", lpString2=".msi") returned -1
	[0078.899] lstrlenW (lpString=".hta") returned 4
	[0078.899] lstrcmpiW (lpString1=".hta", lpString2=".msi") returned -1
	[0078.899] lstrlenW (lpString=".htc") returned 4
	[0078.900] lstrcmpiW (lpString1=".htc", lpString2=".msi") returned -1
	[0078.900] lstrlenW (lpString=".htm") returned 4
	[0078.900] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1
	[0078.900] lstrlenW (lpString=".html") returned 5
	[0078.900] lstrcmpiW (lpString1=".html", lpString2="W.msi") returned -1
	[0078.900] lstrlenW (lpString=".icb") returned 4
	[0078.900] lstrcmpiW (lpString1=".icb", lpString2=".msi") returned -1
	[0078.901] lstrlenW (lpString=".ics") returned 4
	[0078.901] lstrcmpiW (lpString1=".ics", lpString2=".msi") returned -1
	[0078.901] lstrlenW (lpString=".iff") returned 4
	[0078.901] lstrcmpiW (lpString1=".iff", lpString2=".msi") returned -1
	[0078.901] lstrlenW (lpString=".inc") returned 4
	[0078.901] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1
	[0078.902] lstrlenW (lpString=".indd") returned 5
	[0078.902] lstrcmpiW (lpString1=".indd", lpString2="W.msi") returned -1
	[0078.902] lstrlenW (lpString=".ini") returned 4
	[0078.902] lstrcmpiW (lpString1=".ini", lpString2=".msi") returned -1
	[0078.902] lstrlenW (lpString=".iqy") returned 4
	[0078.902] lstrcmpiW (lpString1=".iqy", lpString2=".msi") returned -1
	[0078.902] lstrlenW (lpString=".j2c") returned 4
	[0078.903] lstrcmpiW (lpString1=".j2c", lpString2=".msi") returned -1
	[0078.903] lstrlenW (lpString=".j2k") returned 4
	[0078.903] lstrcmpiW (lpString1=".j2k", lpString2=".msi") returned -1
	[0078.903] lstrlenW (lpString=".java") returned 5
	[0078.903] lstrcmpiW (lpString1=".java", lpString2="W.msi") returned -1
	[0078.903] lstrlenW (lpString=".jp2") returned 4
	[0078.903] lstrcmpiW (lpString1=".jp2", lpString2=".msi") returned -1
	[0078.904] lstrlenW (lpString=".jpc") returned 4
	[0078.904] lstrcmpiW (lpString1=".jpc", lpString2=".msi") returned -1
	[0078.904] lstrlenW (lpString=".jpe") returned 4
	[0078.904] lstrcmpiW (lpString1=".jpe", lpString2=".msi") returned -1
	[0078.904] lstrlenW (lpString=".jpeg") returned 5
	[0078.904] lstrcmpiW (lpString1=".jpeg", lpString2="W.msi") returned -1
	[0078.904] lstrlenW (lpString=".jpf") returned 4
	[0078.905] lstrcmpiW (lpString1=".jpf", lpString2=".msi") returned -1
	[0078.905] lstrlenW (lpString=".jpg") returned 4
	[0078.905] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.341] lstrlenW (lpString=".jpx") returned 4
	[0079.341] lstrcmpiW (lpString1=".jpx", lpString2=".msi") returned -1
	[0079.341] lstrlenW (lpString=".js") returned 3
	[0079.341] lstrcmpiW (lpString1=".js", lpString2="msi") returned -1
	[0079.341] lstrlenW (lpString=".jsf") returned 4
	[0079.342] lstrcmpiW (lpString1=".jsf", lpString2=".msi") returned -1
	[0079.342] lstrlenW (lpString=".json") returned 5
	[0079.342] lstrcmpiW (lpString1=".json", lpString2="W.msi") returned -1
	[0079.342] lstrlenW (lpString=".jsp") returned 4
	[0079.342] lstrcmpiW (lpString1=".jsp", lpString2=".msi") returned -1
	[0079.343] lstrlenW (lpString=".kdc") returned 4
	[0079.343] lstrcmpiW (lpString1=".kdc", lpString2=".msi") returned -1
	[0079.343] lstrlenW (lpString=".kmz") returned 4
	[0079.343] lstrcmpiW (lpString1=".kmz", lpString2=".msi") returned -1
	[0079.343] lstrlenW (lpString=".kwm") returned 4
	[0079.344] lstrcmpiW (lpString1=".kwm", lpString2=".msi") returned -1
	[0079.344] lstrlenW (lpString=".lasso") returned 6
	[0079.344] lstrcmpiW (lpString1=".lasso", lpString2="WW.msi") returned -1
	[0079.344] lstrlenW (lpString=".lbi") returned 4
	[0079.344] lstrcmpiW (lpString1=".lbi", lpString2=".msi") returned -1
	[0079.344] lstrlenW (lpString=".lgf") returned 4
	[0079.345] lstrcmpiW (lpString1=".lgf", lpString2=".msi") returned -1
	[0079.345] lstrlenW (lpString=".lgp") returned 4
	[0079.345] lstrcmpiW (lpString1=".lgp", lpString2=".msi") returned -1
	[0079.345] lstrlenW (lpString=".log") returned 4
	[0079.345] lstrcmpiW (lpString1=".log", lpString2=".msi") returned -1
	[0079.346] lstrlenW (lpString=".m1v") returned 4
	[0079.346] lstrcmpiW (lpString1=".m1v", lpString2=".msi") returned -1
	[0079.346] lstrlenW (lpString=".m4a") returned 4
	[0079.346] lstrcmpiW (lpString1=".m4a", lpString2=".msi") returned -1
	[0079.346] lstrlenW (lpString=".m4v") returned 4
	[0079.346] lstrcmpiW (lpString1=".m4v", lpString2=".msi") returned -1
	[0079.347] lstrlenW (lpString=".max") returned 4
	[0079.347] lstrcmpiW (lpString1=".max", lpString2=".msi") returned -1
	[0079.347] lstrlenW (lpString=".md") returned 3
	[0079.347] lstrcmpiW (lpString1=".md", lpString2="msi") returned -1
	[0079.347] lstrlenW (lpString=".mda") returned 4
	[0079.348] lstrcmpiW (lpString1=".mda", lpString2=".msi") returned -1
	[0079.348] lstrlenW (lpString=".mdb") returned 4
	[0079.348] lstrcmpiW (lpString1=".mdb", lpString2=".msi") returned -1
	[0079.348] lstrlenW (lpString=".mde") returned 4
	[0079.348] lstrcmpiW (lpString1=".mde", lpString2=".msi") returned -1
	[0079.349] lstrlenW (lpString=".mdf") returned 4
	[0079.349] lstrcmpiW (lpString1=".mdf", lpString2=".msi") returned -1
	[0079.349] lstrlenW (lpString=".mdw") returned 4
	[0079.349] lstrcmpiW (lpString1=".mdw", lpString2=".msi") returned -1
	[0079.350] lstrlenW (lpString=".mef") returned 4
	[0079.350] lstrcmpiW (lpString1=".mef", lpString2=".msi") returned -1
	[0079.350] lstrlenW (lpString=".mft") returned 4
	[0079.350] lstrcmpiW (lpString1=".mft", lpString2=".msi") returned -1
	[0079.350] lstrlenW (lpString=".mfw") returned 4
	[0079.350] lstrcmpiW (lpString1=".mfw", lpString2=".msi") returned -1
	[0079.351] lstrlenW (lpString=".mht") returned 4
	[0079.351] lstrcmpiW (lpString1=".mht", lpString2=".msi") returned -1
	[0079.351] lstrlenW (lpString=".mhtml") returned 6
	[0079.351] lstrcmpiW (lpString1=".mhtml", lpString2="WW.msi") returned -1
	[0079.351] lstrlenW (lpString=".mka") returned 4
	[0079.351] lstrcmpiW (lpString1=".mka", lpString2=".msi") returned -1
	[0079.352] lstrlenW (lpString=".mkidx") returned 6
	[0079.352] lstrcmpiW (lpString1=".mkidx", lpString2="WW.msi") returned -1
	[0079.352] lstrlenW (lpString=".mkv") returned 4
	[0079.352] lstrcmpiW (lpString1=".mkv", lpString2=".msi") returned -1
	[0079.352] lstrlenW (lpString=".mos") returned 4
	[0079.353] lstrcmpiW (lpString1=".mos", lpString2=".msi") returned -1
	[0079.353] lstrlenW (lpString=".mov") returned 4
	[0079.353] lstrcmpiW (lpString1=".mov", lpString2=".msi") returned -1
	[0079.353] lstrlenW (lpString=".mp3") returned 4
	[0079.353] lstrcmpiW (lpString1=".mp3", lpString2=".msi") returned -1
	[0079.354] lstrlenW (lpString=".mp4") returned 4
	[0079.354] lstrcmpiW (lpString1=".mp4", lpString2=".msi") returned -1
	[0079.354] lstrlenW (lpString=".mpeg") returned 5
	[0079.354] lstrcmpiW (lpString1=".mpeg", lpString2="W.msi") returned -1
	[0079.354] lstrlenW (lpString=".mpg") returned 4
	[0079.354] lstrcmpiW (lpString1=".mpg", lpString2=".msi") returned -1
	[0079.355] lstrlenW (lpString=".mpv") returned 4
	[0079.355] lstrcmpiW (lpString1=".mpv", lpString2=".msi") returned -1
	[0079.355] lstrlenW (lpString=".mrw") returned 4
	[0079.355] lstrcmpiW (lpString1=".mrw", lpString2=".msi") returned -1
	[0079.355] lstrlenW (lpString=".msg") returned 4
	[0079.356] lstrcmpiW (lpString1=".msg", lpString2=".msi") returned -1
	[0079.356] lstrlenW (lpString=".mxl") returned 4
	[0079.356] lstrcmpiW (lpString1=".mxl", lpString2=".msi") returned 1
	[0079.356] lstrlenW (lpString=".myd") returned 4
	[0079.356] lstrcmpiW (lpString1=".myd", lpString2=".msi") returned 1
	[0079.356] lstrlenW (lpString=".myi") returned 4
	[0079.357] lstrcmpiW (lpString1=".myi", lpString2=".msi") returned 1
	[0079.357] lstrlenW (lpString=".nef") returned 4
	[0079.357] lstrcmpiW (lpString1=".nef", lpString2=".msi") returned 1
	[0079.357] lstrlenW (lpString=".nrw") returned 4
	[0079.357] lstrcmpiW (lpString1=".nrw", lpString2=".msi") returned 1
	[0079.357] lstrlenW (lpString=".obj") returned 4
	[0079.358] lstrcmpiW (lpString1=".obj", lpString2=".msi") returned 1
	[0079.358] lstrlenW (lpString=".odb") returned 4
	[0079.358] lstrcmpiW (lpString1=".odb", lpString2=".msi") returned 1
	[0079.358] lstrlenW (lpString=".odc") returned 4
	[0079.358] lstrcmpiW (lpString1=".odc", lpString2=".msi") returned 1
	[0079.359] lstrlenW (lpString=".odm") returned 4
	[0079.359] lstrcmpiW (lpString1=".odm", lpString2=".msi") returned 1
	[0079.359] lstrlenW (lpString=".odp") returned 4
	[0079.359] lstrcmpiW (lpString1=".odp", lpString2=".msi") returned 1
	[0079.359] lstrlenW (lpString=".ods") returned 4
	[0079.360] lstrcmpiW (lpString1=".ods", lpString2=".msi") returned 1
	[0079.360] lstrlenW (lpString=".oft") returned 4
	[0079.360] lstrcmpiW (lpString1=".oft", lpString2=".msi") returned 1
	[0079.360] lstrlenW (lpString=".one") returned 4
	[0079.360] lstrcmpiW (lpString1=".one", lpString2=".msi") returned 1
	[0079.360] lstrlenW (lpString=".onepkg") returned 7
	[0079.360] lstrcmpiW (lpString1=".onepkg", lpString2="2WW.msi") returned -1
	[0079.361] lstrlenW (lpString=".onetoc2") returned 8
	[0079.361] lstrcmpiW (lpString1=".onetoc2", lpString2="32WW.msi") returned -1
	[0079.361] lstrlenW (lpString=".opt") returned 4
	[0079.361] lstrcmpiW (lpString1=".opt", lpString2=".msi") returned 1
	[0079.361] lstrlenW (lpString=".oqy") returned 4
	[0079.361] lstrcmpiW (lpString1=".oqy", lpString2=".msi") returned 1
	[0079.362] lstrlenW (lpString=".orf") returned 4
	[0079.362] lstrcmpiW (lpString1=".orf", lpString2=".msi") returned 1
	[0079.362] lstrlenW (lpString=".p12") returned 4
	[0079.362] lstrcmpiW (lpString1=".p12", lpString2=".msi") returned 1
	[0079.362] lstrlenW (lpString=".p7b") returned 4
	[0079.362] lstrcmpiW (lpString1=".p7b", lpString2=".msi") returned 1
	[0079.363] lstrlenW (lpString=".p7c") returned 4
	[0079.363] lstrcmpiW (lpString1=".p7c", lpString2=".msi") returned 1
	[0079.363] lstrlenW (lpString=".pam") returned 4
	[0079.363] lstrcmpiW (lpString1=".pam", lpString2=".msi") returned 1
	[0079.363] lstrlenW (lpString=".pbm") returned 4
	[0079.363] lstrcmpiW (lpString1=".pbm", lpString2=".msi") returned 1
	[0079.364] lstrlenW (lpString=".pct") returned 4
	[0079.364] lstrcmpiW (lpString1=".pct", lpString2=".msi") returned 1
	[0079.364] lstrlenW (lpString=".pcx") returned 4
	[0079.364] lstrcmpiW (lpString1=".pcx", lpString2=".msi") returned 1
	[0079.364] lstrlenW (lpString=".pdd") returned 4
	[0079.364] lstrcmpiW (lpString1=".pdd", lpString2=".msi") returned 1
	[0079.365] lstrlenW (lpString=".pdf") returned 4
	[0079.365] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.365] lstrlenW (lpString=".pdp") returned 4
	[0079.365] lstrcmpiW (lpString1=".pdp", lpString2=".msi") returned 1
	[0079.365] lstrlenW (lpString=".pef") returned 4
	[0079.365] lstrcmpiW (lpString1=".pef", lpString2=".msi") returned 1
	[0079.366] lstrlenW (lpString=".pem") returned 4
	[0079.366] lstrcmpiW (lpString1=".pem", lpString2=".msi") returned 1
	[0079.366] lstrlenW (lpString=".pff") returned 4
	[0079.366] lstrcmpiW (lpString1=".pff", lpString2=".msi") returned 1
	[0079.366] lstrlenW (lpString=".pfm") returned 4
	[0079.366] lstrcmpiW (lpString1=".pfm", lpString2=".msi") returned 1
	[0079.367] lstrlenW (lpString=".pfx") returned 4
	[0079.367] lstrcmpiW (lpString1=".pfx", lpString2=".msi") returned 1
	[0079.367] lstrlenW (lpString=".pgm") returned 4
	[0079.367] lstrcmpiW (lpString1=".pgm", lpString2=".msi") returned 1
	[0079.367] lstrlenW (lpString=".php") returned 4
	[0079.368] lstrcmpiW (lpString1=".php", lpString2=".msi") returned 1
	[0079.368] lstrlenW (lpString=".php3") returned 5
	[0079.368] lstrcmpiW (lpString1=".php3", lpString2="W.msi") returned -1
	[0079.368] lstrlenW (lpString=".php4") returned 5
	[0079.368] lstrcmpiW (lpString1=".php4", lpString2="W.msi") returned -1
	[0079.368] lstrlenW (lpString=".php5") returned 5
	[0079.368] lstrcmpiW (lpString1=".php5", lpString2="W.msi") returned -1
	[0079.369] lstrlenW (lpString=".phtml") returned 6
	[0079.369] lstrcmpiW (lpString1=".phtml", lpString2="WW.msi") returned -1
	[0079.369] lstrlenW (lpString=".pict") returned 5
	[0079.369] lstrcmpiW (lpString1=".pict", lpString2="W.msi") returned -1
	[0079.369] lstrlenW (lpString=".pl") returned 3
	[0079.369] lstrcmpiW (lpString1=".pl", lpString2="msi") returned -1
	[0079.370] lstrlenW (lpString=".pls") returned 4
	[0079.370] lstrcmpiW (lpString1=".pls", lpString2=".msi") returned 1
	[0079.370] lstrlenW (lpString=".pm") returned 3
	[0079.370] lstrcmpiW (lpString1=".pm", lpString2="msi") returned -1
	[0079.370] lstrlenW (lpString=".png") returned 4
	[0079.371] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1
	[0079.371] lstrlenW (lpString=".pnm") returned 4
	[0079.371] lstrcmpiW (lpString1=".pnm", lpString2=".msi") returned 1
	[0079.371] lstrlenW (lpString=".pot") returned 4
	[0079.371] lstrcmpiW (lpString1=".pot", lpString2=".msi") returned 1
	[0079.372] lstrlenW (lpString=".potm") returned 5
	[0079.372] lstrcmpiW (lpString1=".potm", lpString2="W.msi") returned -1
	[0079.372] lstrlenW (lpString=".potx") returned 5
	[0079.372] lstrcmpiW (lpString1=".potx", lpString2="W.msi") returned -1
	[0079.372] lstrlenW (lpString=".ppa") returned 4
	[0079.372] lstrcmpiW (lpString1=".ppa", lpString2=".msi") returned 1
	[0079.373] lstrlenW (lpString=".ppam") returned 5
	[0079.373] lstrcmpiW (lpString1=".ppam", lpString2="W.msi") returned -1
	[0079.852] lstrlenW (lpString=".ppm") returned 4
	[0079.852] lstrcmpiW (lpString1=".ppm", lpString2=".msi") returned 1
	[0079.853] lstrlenW (lpString=".pps") returned 4
	[0079.853] lstrcmpiW (lpString1=".pps", lpString2=".msi") returned 1
	[0079.853] lstrlenW (lpString=".ppsm") returned 5
	[0079.853] lstrcmpiW (lpString1=".ppsm", lpString2="W.msi") returned -1
	[0079.853] lstrlenW (lpString=".ppt") returned 4
	[0079.853] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.854] lstrlenW (lpString=".pptm") returned 5
	[0079.854] lstrcmpiW (lpString1=".pptm", lpString2="W.msi") returned -1
	[0079.854] lstrlenW (lpString=".pptx") returned 5
	[0079.854] lstrcmpiW (lpString1=".pptx", lpString2="W.msi") returned -1
	[0079.854] lstrlenW (lpString=".prn") returned 4
	[0079.855] lstrcmpiW (lpString1=".prn", lpString2=".msi") returned 1
	[0079.855] lstrlenW (lpString=".ps") returned 3
	[0079.855] lstrcmpiW (lpString1=".ps", lpString2="msi") returned -1
	[0079.855] lstrlenW (lpString=".psb") returned 4
	[0079.855] lstrcmpiW (lpString1=".psb", lpString2=".msi") returned 1
	[0079.856] lstrlenW (lpString=".psd") returned 4
	[0079.856] lstrcmpiW (lpString1=".psd", lpString2=".msi") returned 1
	[0079.856] lstrlenW (lpString=".pst") returned 4
	[0079.856] lstrcmpiW (lpString1=".pst", lpString2=".msi") returned 1
	[0079.856] lstrlenW (lpString=".ptx") returned 4
	[0079.857] lstrcmpiW (lpString1=".ptx", lpString2=".msi") returned 1
	[0079.857] lstrlenW (lpString=".pub") returned 4
	[0079.857] lstrcmpiW (lpString1=".pub", lpString2=".msi") returned 1
	[0079.857] lstrlenW (lpString=".pwm") returned 4
	[0079.858] lstrcmpiW (lpString1=".pwm", lpString2=".msi") returned 1
	[0079.858] lstrlenW (lpString=".pxr") returned 4
	[0079.858] lstrcmpiW (lpString1=".pxr", lpString2=".msi") returned 1
	[0079.858] lstrlenW (lpString=".py") returned 3
	[0079.858] lstrcmpiW (lpString1=".py", lpString2="msi") returned -1
	[0079.859] lstrlenW (lpString=".qt") returned 3
	[0079.859] lstrcmpiW (lpString1=".qt", lpString2="msi") returned -1
	[0079.859] lstrlenW (lpString=".r3d") returned 4
	[0079.859] lstrcmpiW (lpString1=".r3d", lpString2=".msi") returned 1
	[0079.859] lstrlenW (lpString=".raf") returned 4
	[0079.859] lstrcmpiW (lpString1=".raf", lpString2=".msi") returned 1
	[0079.860] lstrlenW (lpString=".rar") returned 4
	[0079.860] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.860] lstrlenW (lpString=".raw") returned 4
	[0079.860] lstrcmpiW (lpString1=".raw", lpString2=".msi") returned 1
	[0079.860] lstrlenW (lpString=".rdf") returned 4
	[0079.860] lstrcmpiW (lpString1=".rdf", lpString2=".msi") returned 1
	[0079.861] lstrlenW (lpString=".rgbe") returned 5
	[0079.861] lstrcmpiW (lpString1=".rgbe", lpString2="W.msi") returned -1
	[0079.861] lstrlenW (lpString=".rle") returned 4
	[0079.861] lstrcmpiW (lpString1=".rle", lpString2=".msi") returned 1
	[0079.861] lstrlenW (lpString=".rqy") returned 4
	[0079.861] lstrcmpiW (lpString1=".rqy", lpString2=".msi") returned 1
	[0079.862] lstrlenW (lpString=".rss") returned 4
	[0079.862] lstrcmpiW (lpString1=".rss", lpString2=".msi") returned 1
	[0079.862] lstrlenW (lpString=".rtf") returned 4
	[0079.862] lstrcmpiW (lpString1=".rtf", lpString2=".msi") returned 1
	[0079.862] lstrlenW (lpString=".rw2") returned 4
	[0079.863] lstrcmpiW (lpString1=".rw2", lpString2=".msi") returned 1
	[0079.863] lstrlenW (lpString=".rwl") returned 4
	[0079.863] lstrcmpiW (lpString1=".rwl", lpString2=".msi") returned 1
	[0079.863] lstrlenW (lpString=".safe") returned 5
	[0079.863] lstrcmpiW (lpString1=".safe", lpString2="W.msi") returned -1
	[0079.863] lstrlenW (lpString=".sct") returned 4
	[0079.864] lstrcmpiW (lpString1=".sct", lpString2=".msi") returned 1
	[0079.864] lstrlenW (lpString=".sdpx") returned 5
	[0079.864] lstrcmpiW (lpString1=".sdpx", lpString2="W.msi") returned -1
	[0079.864] lstrlenW (lpString=".shtm") returned 5
	[0079.864] lstrcmpiW (lpString1=".shtm", lpString2="W.msi") returned -1
	[0079.864] lstrlenW (lpString=".shtml") returned 6
	[0079.865] lstrcmpiW (lpString1=".shtml", lpString2="WW.msi") returned -1
	[0079.865] lstrlenW (lpString=".slk") returned 4
	[0079.865] lstrcmpiW (lpString1=".slk", lpString2=".msi") returned 1
	[0079.865] lstrlenW (lpString=".sln") returned 4
	[0079.865] lstrcmpiW (lpString1=".sln", lpString2=".msi") returned 1
	[0079.865] lstrlenW (lpString=".sql") returned 4
	[0079.866] lstrcmpiW (lpString1=".sql", lpString2=".msi") returned 1
	[0079.866] lstrlenW (lpString=".sr2") returned 4
	[0079.866] lstrcmpiW (lpString1=".sr2", lpString2=".msi") returned 1
	[0079.866] lstrlenW (lpString=".srf") returned 4
	[0079.866] lstrcmpiW (lpString1=".srf", lpString2=".msi") returned 1
	[0079.866] lstrlenW (lpString=".srw") returned 4
	[0079.867] lstrcmpiW (lpString1=".srw", lpString2=".msi") returned 1
	[0079.867] lstrlenW (lpString=".ssi") returned 4
	[0079.867] lstrcmpiW (lpString1=".ssi", lpString2=".msi") returned 1
	[0079.867] lstrlenW (lpString=".st") returned 3
	[0079.867] lstrcmpiW (lpString1=".st", lpString2="msi") returned -1
	[0079.867] lstrlenW (lpString=".stm") returned 4
	[0079.868] lstrcmpiW (lpString1=".stm", lpString2=".msi") returned 1
	[0079.868] lstrlenW (lpString=".svg") returned 4
	[0079.868] lstrcmpiW (lpString1=".svg", lpString2=".msi") returned 1
	[0079.868] lstrlenW (lpString=".svgz") returned 5
	[0079.868] lstrcmpiW (lpString1=".svgz", lpString2="W.msi") returned -1
	[0079.868] lstrlenW (lpString=".swf") returned 4
	[0079.869] lstrcmpiW (lpString1=".swf", lpString2=".msi") returned 1
	[0079.869] lstrlenW (lpString=".tab") returned 4
	[0079.869] lstrcmpiW (lpString1=".tab", lpString2=".msi") returned 1
	[0079.869] lstrlenW (lpString=".tar") returned 4
	[0079.869] lstrcmpiW (lpString1=".tar", lpString2=".msi") returned 1
	[0079.869] lstrlenW (lpString=".tbb") returned 4
	[0079.870] lstrcmpiW (lpString1=".tbb", lpString2=".msi") returned 1
	[0079.870] lstrlenW (lpString=".tbi") returned 4
	[0079.870] lstrcmpiW (lpString1=".tbi", lpString2=".msi") returned 1
	[0079.870] lstrlenW (lpString=".tbk") returned 4
	[0079.870] lstrcmpiW (lpString1=".tbk", lpString2=".msi") returned 1
	[0079.870] lstrlenW (lpString=".tdi") returned 4
	[0079.870] lstrcmpiW (lpString1=".tdi", lpString2=".msi") returned 1
	[0079.871] lstrlenW (lpString=".tga") returned 4
	[0079.871] lstrcmpiW (lpString1=".tga", lpString2=".msi") returned 1
	[0079.871] lstrlenW (lpString=".thmx") returned 5
	[0079.871] lstrcmpiW (lpString1=".thmx", lpString2="W.msi") returned -1
	[0079.871] lstrlenW (lpString=".tif") returned 4
	[0079.872] lstrcmpiW (lpString1=".tif", lpString2=".msi") returned 1
	[0079.872] lstrlenW (lpString=".tiff") returned 5
	[0079.872] lstrcmpiW (lpString1=".tiff", lpString2="W.msi") returned -1
	[0079.872] lstrlenW (lpString=".tld") returned 4
	[0079.872] lstrcmpiW (lpString1=".tld", lpString2=".msi") returned 1
	[0079.887] lstrlenW (lpString=".torrent") returned 8
	[0079.887] lstrcmpiW (lpString1=".torrent", lpString2="32WW.msi") returned -1
	[0079.887] lstrlenW (lpString=".tpl") returned 4
	[0079.887] lstrcmpiW (lpString1=".tpl", lpString2=".msi") returned 1
	[0079.887] lstrlenW (lpString=".txt") returned 4
	[0079.888] lstrcmpiW (lpString1=".txt", lpString2=".msi") returned 1
	[0079.888] lstrlenW (lpString=".u3d") returned 4
	[0079.888] lstrcmpiW (lpString1=".u3d", lpString2=".msi") returned 1
	[0079.888] lstrlenW (lpString=".udl") returned 4
	[0079.888] lstrcmpiW (lpString1=".udl", lpString2=".msi") returned 1
	[0079.888] lstrlenW (lpString=".uxdc") returned 5
	[0079.889] lstrcmpiW (lpString1=".uxdc", lpString2="W.msi") returned -1
	[0079.889] lstrlenW (lpString=".vb") returned 3
	[0079.889] lstrcmpiW (lpString1=".vb", lpString2="msi") returned -1
	[0079.889] lstrlenW (lpString=".vbs") returned 4
	[0079.889] lstrcmpiW (lpString1=".vbs", lpString2=".msi") returned 1
	[0079.889] lstrlenW (lpString=".vcs") returned 4
	[0079.890] lstrcmpiW (lpString1=".vcs", lpString2=".msi") returned 1
	[0079.890] lstrlenW (lpString=".vda") returned 4
	[0079.890] lstrcmpiW (lpString1=".vda", lpString2=".msi") returned 1
	[0079.890] lstrlenW (lpString=".vdr") returned 4
	[0079.890] lstrcmpiW (lpString1=".vdr", lpString2=".msi") returned 1
	[0079.890] lstrlenW (lpString=".vdw") returned 4
	[0079.891] lstrcmpiW (lpString1=".vdw", lpString2=".msi") returned 1
	[0079.891] lstrlenW (lpString=".vdx") returned 4
	[0079.891] lstrcmpiW (lpString1=".vdx", lpString2=".msi") returned 1
	[0079.891] lstrlenW (lpString=".vrp") returned 4
	[0079.891] lstrcmpiW (lpString1=".vrp", lpString2=".msi") returned 1
	[0079.891] lstrlenW (lpString=".vsd") returned 4
	[0079.892] lstrcmpiW (lpString1=".vsd", lpString2=".msi") returned 1
	[0079.892] lstrlenW (lpString=".vss") returned 4
	[0079.892] lstrcmpiW (lpString1=".vss", lpString2=".msi") returned 1
	[0079.892] lstrlenW (lpString=".vst") returned 4
	[0079.892] lstrcmpiW (lpString1=".vst", lpString2=".msi") returned 1
	[0079.892] lstrlenW (lpString=".vsw") returned 4
	[0079.893] lstrcmpiW (lpString1=".vsw", lpString2=".msi") returned 1
	[0079.893] lstrlenW (lpString=".vsx") returned 4
	[0079.893] lstrcmpiW (lpString1=".vsx", lpString2=".msi") returned 1
	[0079.893] lstrlenW (lpString=".vtm") returned 4
	[0079.893] lstrcmpiW (lpString1=".vtm", lpString2=".msi") returned 1
	[0079.893] lstrlenW (lpString=".vtml") returned 5
	[0079.894] lstrcmpiW (lpString1=".vtml", lpString2="W.msi") returned -1
	[0079.894] lstrlenW (lpString=".vtx") returned 4
	[0079.894] lstrcmpiW (lpString1=".vtx", lpString2=".msi") returned 1
	[0079.894] lstrlenW (lpString=".wb2") returned 4
	[0079.894] lstrcmpiW (lpString1=".wb2", lpString2=".msi") returned 1
	[0079.895] lstrlenW (lpString=".wav") returned 4
	[0079.895] lstrcmpiW (lpString1=".wav", lpString2=".msi") returned 1
	[0079.895] lstrlenW (lpString=".wbm") returned 4
	[0079.895] lstrcmpiW (lpString1=".wbm", lpString2=".msi") returned 1
	[0079.895] lstrlenW (lpString=".wbmp") returned 5
	[0079.895] lstrcmpiW (lpString1=".wbmp", lpString2="W.msi") returned -1
	[0079.896] lstrlenW (lpString=".wim") returned 4
	[0079.896] lstrcmpiW (lpString1=".wim", lpString2=".msi") returned 1
	[0079.896] lstrlenW (lpString=".wmf") returned 4
	[0079.896] lstrcmpiW (lpString1=".wmf", lpString2=".msi") returned 1
	[0079.896] lstrlenW (lpString=".wml") returned 4
	[0079.897] lstrcmpiW (lpString1=".wml", lpString2=".msi") returned 1
	[0079.897] lstrlenW (lpString=".wmv") returned 4
	[0079.897] lstrcmpiW (lpString1=".wmv", lpString2=".msi") returned 1
	[0079.897] lstrlenW (lpString=".wpd") returned 4
	[0079.897] lstrcmpiW (lpString1=".wpd", lpString2=".msi") returned 1
	[0079.898] lstrlenW (lpString=".wps") returned 4
	[0079.898] lstrcmpiW (lpString1=".wps", lpString2=".msi") returned 1
	[0079.898] lstrlenW (lpString=".x3f") returned 4
	[0079.898] lstrcmpiW (lpString1=".x3f", lpString2=".msi") returned 1
	[0079.898] lstrlenW (lpString=".xl") returned 3
	[0079.899] lstrcmpiW (lpString1=".xl", lpString2="msi") returned -1
	[0079.899] lstrlenW (lpString=".xla") returned 4
	[0079.899] lstrcmpiW (lpString1=".xla", lpString2=".msi") returned 1
	[0079.899] lstrlenW (lpString=".xlam") returned 5
	[0079.899] lstrcmpiW (lpString1=".xlam", lpString2="W.msi") returned -1
	[0079.899] lstrlenW (lpString=".xlk") returned 4
	[0079.900] lstrcmpiW (lpString1=".xlk", lpString2=".msi") returned 1
	[0079.900] lstrlenW (lpString=".xlm") returned 4
	[0079.900] lstrcmpiW (lpString1=".xlm", lpString2=".msi") returned 1
	[0079.900] lstrlenW (lpString=".xls") returned 4
	[0079.900] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.900] lstrlenW (lpString=".xlsb") returned 5
	[0079.901] lstrcmpiW (lpString1=".xlsb", lpString2="W.msi") returned -1
	[0079.901] lstrlenW (lpString=".xlsm") returned 5
	[0079.901] lstrcmpiW (lpString1=".xlsm", lpString2="W.msi") returned -1
	[0079.901] lstrlenW (lpString=".xlsx") returned 5
	[0079.901] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0079.901] lstrlenW (lpString=".xlt") returned 4
	[0079.902] lstrcmpiW (lpString1=".xlt", lpString2=".msi") returned 1
	[0079.902] lstrlenW (lpString=".xltm") returned 5
	[0079.902] lstrcmpiW (lpString1=".xltm", lpString2="W.msi") returned -1
	[0079.902] lstrlenW (lpString=".xltx") returned 5
	[0079.902] lstrcmpiW (lpString1=".xltx", lpString2="W.msi") returned -1
	[0079.902] lstrlenW (lpString=".xlw") returned 4
	[0079.903] lstrcmpiW (lpString1=".xlw", lpString2=".msi") returned 1
	[0079.903] lstrlenW (lpString=".xml") returned 4
	[0079.903] lstrcmpiW (lpString1=".xml", lpString2=".msi") returned 1
	[0079.903] lstrlenW (lpString=".xps") returned 4
	[0079.903] lstrcmpiW (lpString1=".xps", lpString2=".msi") returned 1
	[0079.903] lstrlenW (lpString=".xsd") returned 4
	[0080.100] lstrcmpiW (lpString1=".xsd", lpString2=".msi") returned 1
	[0080.101] lstrlenW (lpString=".xsf") returned 4
	[0080.101] lstrcmpiW (lpString1=".xsf", lpString2=".msi") returned 1
	[0080.101] lstrlenW (lpString=".xsl") returned 4
	[0080.101] lstrcmpiW (lpString1=".xsl", lpString2=".msi") returned 1
	[0080.101] lstrlenW (lpString=".xslt") returned 5
	[0080.101] lstrcmpiW (lpString1=".xslt", lpString2="W.msi") returned -1
	[0080.102] lstrlenW (lpString=".xsn") returned 4
	[0080.102] lstrcmpiW (lpString1=".xsn", lpString2=".msi") returned 1
	[0080.102] lstrlenW (lpString=".xtp") returned 4
	[0080.102] lstrcmpiW (lpString1=".xtp", lpString2=".msi") returned 1
	[0080.102] lstrlenW (lpString=".xtp2") returned 5
	[0080.103] lstrcmpiW (lpString1=".xtp2", lpString2="W.msi") returned -1
	[0080.103] lstrlenW (lpString=".xyze") returned 5
	[0080.103] lstrcmpiW (lpString1=".xyze", lpString2="W.msi") returned -1
	[0080.103] lstrlenW (lpString=".xz") returned 3
	[0080.103] lstrcmpiW (lpString1=".xz", lpString2="msi") returned -1
	[0080.104] lstrlenW (lpString=".zip") returned 4
	[0080.104] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.104] FindNextFileW (in: hFindFile=0x3ec30e8, lpFindFileData=0x2ecf58c | out: lpFindFileData=0x2ecf58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0080.104] lstrlenW (lpString="Office32WW.xml") returned 14
	[0080.105] lstrlenW (lpString=".1cd") returned 4
	[0080.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0080.105] lstrlenW (lpString=".3ds") returned 4
	[0080.105] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0080.105] lstrlenW (lpString=".3fr") returned 4
	[0080.106] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0080.106] lstrlenW (lpString=".3g2") returned 4
	[0080.106] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0080.106] lstrlenW (lpString=".3gp") returned 4
	[0080.107] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0080.107] lstrlenW (lpString=".7z") returned 3
	[0080.107] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0080.107] lstrlenW (lpString=".accda") returned 6
	[0080.107] lstrcmpiW (lpString1=".accda", lpString2="WW.xml") returned -1
	[0080.108] lstrlenW (lpString=".accdb") returned 6
	[0080.108] lstrcmpiW (lpString1=".accdb", lpString2="WW.xml") returned -1
	[0080.108] lstrlenW (lpString=".accdc") returned 6
	[0080.108] lstrcmpiW (lpString1=".accdc", lpString2="WW.xml") returned -1
	[0080.108] lstrlenW (lpString=".accde") returned 6
	[0080.108] lstrcmpiW (lpString1=".accde", lpString2="WW.xml") returned -1
	[0080.109] lstrlenW (lpString=".accdt") returned 6
	[0080.109] lstrcmpiW (lpString1=".accdt", lpString2="WW.xml") returned -1
	[0080.109] lstrlenW (lpString=".accdw") returned 6
	[0080.109] lstrcmpiW (lpString1=".accdw", lpString2="WW.xml") returned -1
	[0080.109] lstrlenW (lpString=".adb") returned 4
	[0080.109] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0080.110] lstrlenW (lpString=".adp") returned 4
	[0080.110] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0080.110] lstrlenW (lpString=".ai") returned 3
	[0080.110] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0080.110] lstrlenW (lpString=".ai3") returned 4
	[0080.110] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0080.111] lstrlenW (lpString=".ai4") returned 4
	[0080.111] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0080.111] lstrlenW (lpString=".ai5") returned 4
	[0080.111] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0080.111] lstrlenW (lpString=".ai6") returned 4
	[0080.111] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0080.112] lstrlenW (lpString=".ai7") returned 4
	[0080.112] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0080.112] lstrlenW (lpString=".ai8") returned 4
	[0080.112] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0080.112] lstrlenW (lpString=".anim") returned 5
	[0080.112] lstrcmpiW (lpString1=".anim", lpString2="W.xml") returned -1
	[0080.113] lstrlenW (lpString=".arw") returned 4
	[0080.113] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0080.113] lstrlenW (lpString=".as") returned 3
	[0080.113] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0080.113] lstrlenW (lpString=".asa") returned 4
	[0080.113] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0080.114] lstrlenW (lpString=".asc") returned 4
	[0080.114] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0080.114] lstrlenW (lpString=".ascx") returned 5
	[0080.114] lstrcmpiW (lpString1=".ascx", lpString2="W.xml") returned -1
	[0080.114] lstrlenW (lpString=".asm") returned 4
	[0080.114] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0080.115] lstrlenW (lpString=".asmx") returned 5
	[0080.115] lstrcmpiW (lpString1=".asmx", lpString2="W.xml") returned -1
	[0080.115] lstrlenW (lpString=".asp") returned 4
	[0080.115] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0080.115] lstrlenW (lpString=".aspx") returned 5
	[0080.115] lstrcmpiW (lpString1=".aspx", lpString2="W.xml") returned -1
	[0080.116] lstrlenW (lpString=".asr") returned 4
	[0080.116] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0080.116] lstrlenW (lpString=".asx") returned 4
	[0080.116] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0080.116] lstrlenW (lpString=".avi") returned 4
	[0080.116] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0080.117] lstrlenW (lpString=".avs") returned 4
	[0080.117] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0080.117] lstrlenW (lpString=".backup") returned 7
	[0080.117] lstrcmpiW (lpString1=".backup", lpString2="2WW.xml") returned -1
	[0080.117] lstrlenW (lpString=".bak") returned 4
	[0080.117] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0080.117] lstrlenW (lpString=".bay") returned 4
	[0080.118] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0080.118] lstrlenW (lpString=".bd") returned 3
	[0080.118] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0080.118] lstrlenW (lpString=".bin") returned 4
	[0080.118] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0080.118] lstrlenW (lpString=".bmp") returned 4
	[0080.119] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0080.119] lstrlenW (lpString=".bz2") returned 4
	[0080.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0080.119] lstrlenW (lpString=".c") returned 2
	[0080.119] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0080.119] lstrlenW (lpString=".cdr") returned 4
	[0080.120] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0080.120] lstrlenW (lpString=".cer") returned 4
	[0080.120] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0080.120] lstrlenW (lpString=".cf") returned 3
	[0080.120] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0080.120] lstrlenW (lpString=".cfc") returned 4
	[0080.120] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0080.121] lstrlenW (lpString=".cfm") returned 4
	[0080.121] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0080.121] lstrlenW (lpString=".cfml") returned 5
	[0080.121] lstrcmpiW (lpString1=".cfml", lpString2="W.xml") returned -1
	[0080.121] lstrlenW (lpString=".cfu") returned 4
	[0080.121] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0080.122] lstrlenW (lpString=".chm") returned 4
	[0080.122] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0080.122] lstrlenW (lpString=".cin") returned 4
	[0080.122] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0080.123] lstrlenW (lpString=".class") returned 6
	[0080.123] lstrcmpiW (lpString1=".class", lpString2="WW.xml") returned -1
	[0080.123] lstrlenW (lpString=".clx") returned 4
	[0080.123] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0080.123] lstrlenW (lpString=".config") returned 7
	[0080.123] lstrcmpiW (lpString1=".config", lpString2="2WW.xml") returned -1
	[0080.124] lstrlenW (lpString=".cpp") returned 4
	[0080.124] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0080.124] lstrlenW (lpString=".cr2") returned 4
	[0080.124] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0080.124] lstrlenW (lpString=".crt") returned 4
	[0080.124] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0080.125] lstrlenW (lpString=".crw") returned 4
	[0080.125] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0080.125] lstrlenW (lpString=".cs") returned 3
	[0080.125] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0080.125] lstrlenW (lpString=".css") returned 4
	[0080.125] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0080.126] lstrlenW (lpString=".csv") returned 4
	[0080.126] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0080.126] lstrlenW (lpString=".cub") returned 4
	[0080.126] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0080.126] lstrlenW (lpString=".dae") returned 4
	[0080.126] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0080.127] lstrlenW (lpString=".dat") returned 4
	[0080.127] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0080.127] lstrlenW (lpString=".db") returned 3
	[0080.127] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0080.127] lstrlenW (lpString=".dbf") returned 4
	[0080.127] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0080.128] lstrlenW (lpString=".dbx") returned 4
	[0080.128] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0080.128] lstrlenW (lpString=".dc3") returned 4
	[0080.128] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0080.128] lstrlenW (lpString=".dcm") returned 4
	[0080.128] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0080.129] lstrlenW (lpString=".dcr") returned 4
	[0080.129] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0080.129] lstrlenW (lpString=".der") returned 4
	[0080.129] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0080.129] lstrlenW (lpString=".dib") returned 4
	[0080.129] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0080.130] lstrlenW (lpString=".dic") returned 4
	[0080.130] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0080.130] lstrlenW (lpString=".dif") returned 4
	[0080.130] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0080.130] lstrlenW (lpString=".divx") returned 5
	[0080.131] lstrcmpiW (lpString1=".divx", lpString2="W.xml") returned -1
	[0080.131] lstrlenW (lpString=".djvu") returned 5
	[0080.131] lstrcmpiW (lpString1=".djvu", lpString2="W.xml") returned -1
	[0080.131] lstrlenW (lpString=".dng") returned 4
	[0080.131] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0080.131] lstrlenW (lpString=".doc") returned 4
	[0080.132] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0080.132] lstrlenW (lpString=".docm") returned 5
	[0080.132] lstrcmpiW (lpString1=".docm", lpString2="W.xml") returned -1
	[0080.132] lstrlenW (lpString=".docx") returned 5
	[0080.132] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0080.132] lstrlenW (lpString=".dot") returned 4
	[0080.132] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0080.133] lstrlenW (lpString=".dotm") returned 5
	[0080.133] lstrcmpiW (lpString1=".dotm", lpString2="W.xml") returned -1
	[0080.133] lstrlenW (lpString=".dotx") returned 5
	[0080.133] lstrcmpiW (lpString1=".dotx", lpString2="W.xml") returned -1
	[0080.133] lstrlenW (lpString=".dpx") returned 4
	[0080.133] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0080.133] lstrlenW (lpString=".dqy") returned 4
	[0080.134] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0080.134] lstrlenW (lpString=".dsn") returned 4
	[0080.134] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0080.134] lstrlenW (lpString=".dt") returned 3
	[0080.134] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0080.134] lstrlenW (lpString=".dtd") returned 4
	[0080.135] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0080.135] lstrlenW (lpString=".dwg") returned 4
	[0080.135] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0080.135] lstrlenW (lpString=".dwt") returned 4
	[0080.135] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0080.135] lstrlenW (lpString=".dx") returned 3
	[0080.136] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0080.136] lstrlenW (lpString=".dxf") returned 4
	[0080.136] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0080.136] lstrlenW (lpString=".edml") returned 5
	[0080.136] lstrcmpiW (lpString1=".edml", lpString2="W.xml") returned -1
	[0080.136] lstrlenW (lpString=".efd") returned 4
	[0080.136] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0080.137] lstrlenW (lpString=".elf") returned 4
	[0080.137] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0080.137] lstrlenW (lpString=".emf") returned 4
	[0080.137] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0080.137] lstrlenW (lpString=".emz") returned 4
	[0080.137] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0080.350] lstrlenW (lpString=".epf") returned 4
	[0080.351] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0080.351] lstrlenW (lpString=".eps") returned 4
	[0080.351] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0080.351] lstrlenW (lpString=".epsf") returned 5
	[0080.351] lstrcmpiW (lpString1=".epsf", lpString2="W.xml") returned -1
	[0080.351] lstrlenW (lpString=".epsp") returned 5
	[0080.351] lstrcmpiW (lpString1=".epsp", lpString2="W.xml") returned -1
	[0080.352] lstrlenW (lpString=".erf") returned 4
	[0080.352] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0080.352] lstrlenW (lpString=".exr") returned 4
	[0080.352] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0080.352] lstrlenW (lpString=".f4v") returned 4
	[0080.352] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0080.353] lstrlenW (lpString=".fido") returned 5
	[0080.353] lstrcmpiW (lpString1=".fido", lpString2="W.xml") returned -1
	[0080.353] lstrlenW (lpString=".flm") returned 4
	[0080.353] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0080.353] lstrlenW (lpString=".flv") returned 4
	[0080.353] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0080.354] lstrlenW (lpString=".frm") returned 4
	[0080.354] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0080.354] lstrlenW (lpString=".fxg") returned 4
	[0080.354] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0080.354] lstrlenW (lpString=".geo") returned 4
	[0080.355] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0080.355] lstrlenW (lpString=".gif") returned 4
	[0080.355] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0080.355] lstrlenW (lpString=".grs") returned 4
	[0080.355] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0080.355] lstrlenW (lpString=".gz") returned 3
	[0080.356] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0080.356] lstrlenW (lpString=".h") returned 2
	[0080.356] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0080.356] lstrlenW (lpString=".hdr") returned 4
	[0080.356] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0080.357] lstrlenW (lpString=".hpp") returned 4
	[0080.357] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0080.357] lstrlenW (lpString=".hta") returned 4
	[0080.357] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0080.357] lstrlenW (lpString=".htc") returned 4
	[0080.357] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0080.358] lstrlenW (lpString=".htm") returned 4
	[0080.358] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1
	[0080.358] lstrlenW (lpString=".html") returned 5
	[0080.358] lstrcmpiW (lpString1=".html", lpString2="W.xml") returned -1
	[0080.358] lstrlenW (lpString=".icb") returned 4
	[0080.358] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1
	[0080.358] lstrlenW (lpString=".ics") returned 4
	[0080.359] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1
	[0080.359] lstrlenW (lpString=".iff") returned 4
	[0080.359] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1
	[0080.359] lstrlenW (lpString=".inc") returned 4
	[0080.359] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1
	[0080.360] lstrlenW (lpString=".indd") returned 5
	[0080.360] lstrcmpiW (lpString1=".indd", lpString2="W.xml") returned -1
	[0080.360] lstrlenW (lpString=".ini") returned 4
	[0080.360] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1
	[0080.360] lstrlenW (lpString=".iqy") returned 4
	[0080.360] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1
	[0080.361] lstrlenW (lpString=".j2c") returned 4
	[0080.361] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1
	[0080.361] lstrlenW (lpString=".j2k") returned 4
	[0080.361] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1
	[0080.361] lstrlenW (lpString=".java") returned 5
	[0080.361] lstrcmpiW (lpString1=".java", lpString2="W.xml") returned -1
	[0080.362] lstrlenW (lpString=".jp2") returned 4
	[0080.362] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1
	[0080.362] lstrlenW (lpString=".jpc") returned 4
	[0080.362] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1
	[0080.951] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us") returned 1
	[0080.952] lstrcmpiW (lpString1="C:\\Windows", lpString2="Access.en-us") returned 1
	[0080.952] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3ee3fe0
	[0080.953] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0080.953] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1
	[0080.954] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1
	[0080.954] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1
	[0080.954] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1
	[0080.954] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0080.954] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1
	[0080.954] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1
	[0080.955] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1
	[0080.955] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1
	[0080.955] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1
	[0080.956] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1
	[0080.956] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1
	[0080.956] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1
	[0080.956] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1
	[0080.956] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1
	[0080.956] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1
	[0080.957] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1
	[0080.957] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1
	[0080.957] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1
	[0080.957] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1
	[0080.957] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1
	[0080.957] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1
	[0080.958] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1
	[0080.958] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1
	[0080.958] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1
	[0080.958] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1
	[0080.958] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1
	[0080.959] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1
	[0080.959] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1
	[0080.959] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1
	[0080.959] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1
	[0080.959] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1
	[0080.960] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1
	[0080.960] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1
	[0080.960] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1
	[0080.960] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1
	[0080.960] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1
	[0080.960] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1
	[0080.961] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1
	[0080.961] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1
	[0080.961] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0080.961] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1
	[0080.961] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1
	[0080.962] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1
	[0080.962] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1
	[0080.962] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1
	[0080.962] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1
	[0080.962] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1
	[0080.962] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1
	[0080.963] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1
	[0080.963] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1
	[0080.963] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1
	[0080.963] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1
	[0080.964] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1
	[0080.964] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1
	[0080.964] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1
	[0080.964] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1
	[0080.965] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1
	[0080.966] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1
	[0080.966] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1
	[0080.966] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1
	[0080.966] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1
	[0080.966] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1
	[0080.966] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1
	[0080.967] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1
	[0080.967] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0080.967] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1
	[0080.967] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1
	[0080.967] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1
	[0080.967] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1
	[0080.968] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1
	[0080.968] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1
	[0080.968] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1
	[0080.968] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1
	[0080.968] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1
	[0080.969] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1
	[0080.969] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1
	[0080.969] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0080.969] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1
	[0080.969] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0080.969] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1
	[0080.970] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1
	[0080.970] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1
	[0080.970] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1
	[0080.970] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1
	[0080.970] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1
	[0080.971] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1
	[0080.971] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1
	[0080.971] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1
	[0080.971] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1
	[0080.971] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1
	[0080.971] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1
	[0080.972] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1
	[0080.972] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1
	[0080.972] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1
	[0080.972] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1
	[0080.972] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1
	[0080.973] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1
	[0080.973] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1
	[0080.973] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1
	[0080.973] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1
	[0080.973] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1
	[0080.974] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1
	[0080.974] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1
	[0080.974] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1
	[0080.974] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1
	[0080.974] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1
	[0080.974] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1
	[0080.975] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1
	[0080.975] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1
	[0080.975] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1
	[0080.975] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1
	[0080.975] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1
	[0080.976] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1
	[0080.976] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1
	[0080.976] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1
	[0080.976] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1
	[0080.976] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1
	[0080.977] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1
	[0080.977] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1
	[0080.977] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1
	[0080.977] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1
	[0080.977] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1
	[0080.977] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1
	[0080.978] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1
	[0080.978] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1
	[0080.978] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1
	[0080.978] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1
	[0080.978] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1
	[0080.978] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1
	[0080.979] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1
	[0080.979] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1
	[0080.979] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1
	[0080.979] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1
	[0080.979] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1
	[0080.979] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0080.979] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1
	[0080.980] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1
	[0080.980] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1
	[0080.981] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1
	[0080.981] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1
	[0080.981] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1
	[0080.981] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1
	[0080.982] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1
	[0080.982] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1
	[0080.982] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1
	[0080.982] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1
	[0080.982] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1
	[0080.982] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1
	[0080.983] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1
	[0080.983] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1
	[0080.983] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1
	[0080.983] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1
	[0080.983] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1
	[0080.983] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1
	[0080.984] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1
	[0080.984] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1
	[0080.984] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1
	[0080.984] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1
	[0080.984] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1
	[0080.984] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1
	[0080.985] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1
	[0080.985] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1
	[0080.985] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1
	[0080.985] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1
	[0080.985] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1
	[0080.985] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1
	[0080.986] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1
	[0080.986] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1
	[0080.986] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1
	[0080.986] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1
	[0080.986] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1
	[0080.986] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1
	[0080.987] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1
	[0080.987] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1
	[0080.987] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1
	[0080.987] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1
	[0080.987] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1
	[0080.987] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1
	[0080.988] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1
	[0080.988] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1
	[0080.988] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1
	[0080.988] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1
	[0080.988] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1
	[0080.988] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1
	[0080.989] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1
	[0080.989] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1
	[0080.989] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1
	[0080.989] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1
	[0080.989] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1
	[0080.989] lstrcmpiW (lpString1=".onetoc2", lpString2="sMUI.XML") returned -1
	[0080.990] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1
	[0080.990] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1
	[0080.990] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1
	[0080.990] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1
	[0080.990] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1
	[0080.991] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1
	[0080.991] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1
	[0080.991] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1
	[0080.991] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1
	[0080.991] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1
	[0080.991] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1
	[0080.992] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0080.992] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1
	[0080.992] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1
	[0080.992] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1
	[0080.992] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1
	[0080.993] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1
	[0080.993] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1
	[0080.993] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1
	[0080.993] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1
	[0080.993] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1
	[0080.993] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1
	[0080.994] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1
	[0080.994] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1
	[0080.994] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1
	[0080.994] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1
	[0080.994] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1
	[0080.995] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1
	[0080.995] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1
	[0080.995] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1
	[0080.995] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1
	[0080.995] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1
	[0080.996] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1
	[0086.258] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1
	[0086.258] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1
	[0086.258] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1
	[0086.259] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1
	[0086.259] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1
	[0086.259] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1
	[0086.259] lstrcmpiW (lpString1=".accda", lpString2="IS.ELM") returned -1
	[0086.259] lstrcmpiW (lpString1=".accdb", lpString2="IS.ELM") returned -1
	[0086.260] lstrcmpiW (lpString1=".accdc", lpString2="IS.ELM") returned -1
	[0086.260] lstrcmpiW (lpString1=".accde", lpString2="IS.ELM") returned -1
	[0086.260] lstrcmpiW (lpString1=".accdt", lpString2="IS.ELM") returned -1
	[0086.260] lstrcmpiW (lpString1=".accdw", lpString2="IS.ELM") returned -1
	[0086.260] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1
	[0086.260] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1
	[0086.261] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1
	[0086.261] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1
	[0086.261] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1
	[0086.261] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1
	[0086.261] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1
	[0086.261] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1
	[0086.262] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1
	[0086.262] lstrcmpiW (lpString1=".anim", lpString2="S.ELM") returned -1
	[0086.262] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1
	[0086.262] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1
	[0086.262] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1
	[0086.262] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1
	[0086.262] lstrcmpiW (lpString1=".ascx", lpString2="S.ELM") returned -1
	[0086.263] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1
	[0086.263] lstrcmpiW (lpString1=".asmx", lpString2="S.ELM") returned -1
	[0086.263] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1
	[0086.263] lstrcmpiW (lpString1=".aspx", lpString2="S.ELM") returned -1
	[0086.263] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1
	[0086.264] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1
	[0086.264] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1
	[0086.264] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1
	[0086.264] lstrcmpiW (lpString1=".backup", lpString2="XIS.ELM") returned -1
	[0086.264] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1
	[0086.264] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1
	[0086.264] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1
	[0086.265] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1
	[0086.265] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1
	[0086.265] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1
	[0086.265] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1
	[0086.265] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1
	[0086.265] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1
	[0086.266] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1
	[0086.266] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1
	[0086.266] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1
	[0086.266] lstrcmpiW (lpString1=".cfml", lpString2="S.ELM") returned -1
	[0086.266] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1
	[0086.266] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1
	[0086.266] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1
	[0086.267] lstrcmpiW (lpString1=".class", lpString2="IS.ELM") returned -1
	[0086.267] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1
	[0086.267] lstrcmpiW (lpString1=".config", lpString2="XIS.ELM") returned -1
	[0086.267] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1
	[0086.267] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1
	[0086.267] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1
	[0086.268] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1
	[0086.268] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1
	[0086.268] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1
	[0086.268] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1
	[0086.269] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1
	[0086.269] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1
	[0086.269] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1
	[0086.269] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1
	[0086.270] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1
	[0086.270] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1
	[0086.270] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1
	[0086.270] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1
	[0086.270] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1
	[0086.270] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1
	[0086.271] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1
	[0086.271] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1
	[0086.271] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1
	[0086.271] lstrcmpiW (lpString1=".divx", lpString2="S.ELM") returned -1
	[0086.271] lstrcmpiW (lpString1=".djvu", lpString2="S.ELM") returned -1
	[0086.271] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1
	[0086.272] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1
	[0086.272] lstrcmpiW (lpString1=".docm", lpString2="S.ELM") returned -1
	[0086.272] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1
	[0086.272] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1
	[0086.272] lstrcmpiW (lpString1=".dotm", lpString2="S.ELM") returned -1
	[0086.272] lstrcmpiW (lpString1=".dotx", lpString2="S.ELM") returned -1
	[0086.272] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1
	[0086.273] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1
	[0086.273] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1
	[0086.273] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1
	[0086.273] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1
	[0086.273] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1
	[0086.273] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1
	[0086.273] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1
	[0086.274] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1
	[0086.274] lstrcmpiW (lpString1=".edml", lpString2="S.ELM") returned -1
	[0086.274] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1
	[0086.274] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1
	[0086.274] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1
	[0086.274] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1
	[0086.274] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1
	[0086.274] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1
	[0086.275] lstrcmpiW (lpString1=".epsf", lpString2="S.ELM") returned -1
	[0086.275] lstrcmpiW (lpString1=".epsp", lpString2="S.ELM") returned -1
	[0086.275] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1
	[0086.275] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1
	[0086.275] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1
	[0086.275] lstrcmpiW (lpString1=".fido", lpString2="S.ELM") returned -1
	[0086.276] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1
	[0086.276] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1
	[0086.276] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1
	[0086.276] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1
	[0086.276] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1
	[0086.276] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1
	[0086.276] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1
	[0086.277] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1
	[0086.277] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1
	[0086.277] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1
	[0086.277] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1
	[0086.277] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1
	[0086.277] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1
	[0086.278] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1
	[0086.278] lstrcmpiW (lpString1=".html", lpString2="S.ELM") returned -1
	[0086.278] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1
	[0086.278] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1
	[0086.278] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1
	[0086.278] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1
	[0086.279] lstrcmpiW (lpString1=".indd", lpString2="S.ELM") returned -1
	[0086.279] lstrcmpiW (lpString1=".ini", lpString2=".ELM") returned 1
	[0086.279] lstrcmpiW (lpString1=".iqy", lpString2=".ELM") returned 1
	[0086.279] lstrcmpiW (lpString1=".j2c", lpString2=".ELM") returned 1
	[0086.279] lstrcmpiW (lpString1=".j2k", lpString2=".ELM") returned 1
	[0086.279] lstrcmpiW (lpString1=".java", lpString2="S.ELM") returned -1
	[0086.279] lstrcmpiW (lpString1=".jp2", lpString2=".ELM") returned 1
	[0086.280] lstrcmpiW (lpString1=".jpc", lpString2=".ELM") returned 1
	[0086.280] lstrcmpiW (lpString1=".jpe", lpString2=".ELM") returned 1
	[0086.280] lstrcmpiW (lpString1=".jpeg", lpString2="S.ELM") returned -1
	[0086.280] lstrcmpiW (lpString1=".jpf", lpString2=".ELM") returned 1
	[0086.280] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1
	[0086.280] lstrcmpiW (lpString1=".jpx", lpString2=".ELM") returned 1
	[0086.280] lstrcmpiW (lpString1=".js", lpString2="ELM") returned -1
	[0086.281] lstrcmpiW (lpString1=".jsf", lpString2=".ELM") returned 1
	[0086.281] lstrcmpiW (lpString1=".json", lpString2="S.ELM") returned -1
	[0086.281] lstrcmpiW (lpString1=".jsp", lpString2=".ELM") returned 1
	[0086.281] lstrcmpiW (lpString1=".kdc", lpString2=".ELM") returned 1
	[0086.281] lstrcmpiW (lpString1=".kmz", lpString2=".ELM") returned 1
	[0086.281] lstrcmpiW (lpString1=".kwm", lpString2=".ELM") returned 1
	[0086.281] lstrcmpiW (lpString1=".lasso", lpString2="IS.ELM") returned -1
	[0086.282] lstrcmpiW (lpString1=".lbi", lpString2=".ELM") returned 1
	[0086.282] lstrcmpiW (lpString1=".lgf", lpString2=".ELM") returned 1
	[0086.282] lstrcmpiW (lpString1=".lgp", lpString2=".ELM") returned 1
	[0086.282] lstrcmpiW (lpString1=".log", lpString2=".ELM") returned 1
	[0086.282] lstrcmpiW (lpString1=".m1v", lpString2=".ELM") returned 1
	[0086.282] lstrcmpiW (lpString1=".m4a", lpString2=".ELM") returned 1
	[0086.283] lstrcmpiW (lpString1=".m4v", lpString2=".ELM") returned 1
	[0086.283] lstrcmpiW (lpString1=".max", lpString2=".ELM") returned 1
	[0086.283] lstrcmpiW (lpString1=".md", lpString2="ELM") returned -1
	[0086.283] lstrcmpiW (lpString1=".mda", lpString2=".ELM") returned 1
	[0086.283] lstrcmpiW (lpString1=".mdb", lpString2=".ELM") returned 1
	[0086.283] lstrcmpiW (lpString1=".mde", lpString2=".ELM") returned 1
	[0086.283] lstrcmpiW (lpString1=".mdf", lpString2=".ELM") returned 1
	[0086.284] lstrcmpiW (lpString1=".mdw", lpString2=".ELM") returned 1
	[0086.284] lstrcmpiW (lpString1=".mef", lpString2=".ELM") returned 1
	[0086.284] lstrcmpiW (lpString1=".mft", lpString2=".ELM") returned 1
	[0086.284] lstrcmpiW (lpString1=".mfw", lpString2=".ELM") returned 1
	[0086.284] lstrcmpiW (lpString1=".mht", lpString2=".ELM") returned 1
	[0086.284] lstrcmpiW (lpString1=".mhtml", lpString2="IS.ELM") returned -1
	[0086.284] lstrcmpiW (lpString1=".mka", lpString2=".ELM") returned 1
	[0086.285] lstrcmpiW (lpString1=".mkidx", lpString2="IS.ELM") returned -1
	[0086.285] lstrcmpiW (lpString1=".mkv", lpString2=".ELM") returned 1
	[0086.285] lstrcmpiW (lpString1=".mos", lpString2=".ELM") returned 1
	[0086.285] lstrcmpiW (lpString1=".mov", lpString2=".ELM") returned 1
	[0086.285] lstrcmpiW (lpString1=".mp3", lpString2=".ELM") returned 1
	[0086.285] lstrcmpiW (lpString1=".mp4", lpString2=".ELM") returned 1
	[0086.286] lstrcmpiW (lpString1=".mpeg", lpString2="S.ELM") returned -1
	[0086.286] lstrcmpiW (lpString1=".mpg", lpString2=".ELM") returned 1
	[0086.286] lstrcmpiW (lpString1=".mpv", lpString2=".ELM") returned 1
	[0086.286] lstrcmpiW (lpString1=".mrw", lpString2=".ELM") returned 1
	[0086.286] lstrcmpiW (lpString1=".msg", lpString2=".ELM") returned 1
	[0086.286] lstrcmpiW (lpString1=".mxl", lpString2=".ELM") returned 1
	[0086.286] lstrcmpiW (lpString1=".myd", lpString2=".ELM") returned 1
	[0086.287] lstrcmpiW (lpString1=".myi", lpString2=".ELM") returned 1
	[0086.287] lstrcmpiW (lpString1=".nef", lpString2=".ELM") returned 1
	[0086.287] lstrcmpiW (lpString1=".nrw", lpString2=".ELM") returned 1
	[0086.287] lstrcmpiW (lpString1=".obj", lpString2=".ELM") returned 1
	[0086.287] lstrcmpiW (lpString1=".odb", lpString2=".ELM") returned 1
	[0086.287] lstrcmpiW (lpString1=".odc", lpString2=".ELM") returned 1
	[0086.288] lstrcmpiW (lpString1=".odm", lpString2=".ELM") returned 1
	[0086.288] lstrcmpiW (lpString1=".odp", lpString2=".ELM") returned 1
	[0086.288] lstrcmpiW (lpString1=".ods", lpString2=".ELM") returned 1
	[0086.288] lstrcmpiW (lpString1=".oft", lpString2=".ELM") returned 1
	[0086.289] lstrcmpiW (lpString1=".one", lpString2=".ELM") returned 1
	[0086.289] lstrcmpiW (lpString1=".onepkg", lpString2="XIS.ELM") returned -1
	[0086.289] lstrcmpiW (lpString1=".onetoc2", lpString2="AXIS.ELM") returned -1
	[0086.289] lstrcmpiW (lpString1=".opt", lpString2=".ELM") returned 1
	[0086.289] lstrcmpiW (lpString1=".oqy", lpString2=".ELM") returned 1
	[0086.289] lstrcmpiW (lpString1=".orf", lpString2=".ELM") returned 1
	[0086.290] lstrcmpiW (lpString1=".p12", lpString2=".ELM") returned 1
	[0086.290] lstrcmpiW (lpString1=".p7b", lpString2=".ELM") returned 1
	[0086.290] lstrcmpiW (lpString1=".p7c", lpString2=".ELM") returned 1
	[0086.290] lstrcmpiW (lpString1=".pam", lpString2=".ELM") returned 1
	[0086.290] lstrcmpiW (lpString1=".pbm", lpString2=".ELM") returned 1
	[0086.290] lstrcmpiW (lpString1=".pct", lpString2=".ELM") returned 1
	[0086.290] lstrcmpiW (lpString1=".pcx", lpString2=".ELM") returned 1
	[0086.291] lstrcmpiW (lpString1=".pdd", lpString2=".ELM") returned 1
	[0086.291] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1
	[0086.291] lstrcmpiW (lpString1=".pdp", lpString2=".ELM") returned 1
	[0086.291] lstrcmpiW (lpString1=".pef", lpString2=".ELM") returned 1
	[0086.291] lstrcmpiW (lpString1=".pem", lpString2=".ELM") returned 1
	[0086.291] lstrcmpiW (lpString1=".pff", lpString2=".ELM") returned 1
	[0086.291] lstrcmpiW (lpString1=".pfm", lpString2=".ELM") returned 1
	[0086.292] lstrcmpiW (lpString1=".pfx", lpString2=".ELM") returned 1
	[0086.292] lstrcmpiW (lpString1=".pgm", lpString2=".ELM") returned 1
	[0086.292] lstrcmpiW (lpString1=".php", lpString2=".ELM") returned 1
	[0086.292] lstrcmpiW (lpString1=".php3", lpString2="S.ELM") returned -1
	[0086.292] lstrcmpiW (lpString1=".php4", lpString2="S.ELM") returned -1
	[0086.292] lstrcmpiW (lpString1=".php5", lpString2="S.ELM") returned -1
	[0086.292] lstrcmpiW (lpString1=".phtml", lpString2="IS.ELM") returned -1
	[0086.293] lstrcmpiW (lpString1=".pict", lpString2="S.ELM") returned -1
	[0086.293] lstrcmpiW (lpString1=".pl", lpString2="ELM") returned -1
	[0086.293] lstrcmpiW (lpString1=".pls", lpString2=".ELM") returned 1
	[0086.293] lstrcmpiW (lpString1=".pm", lpString2="ELM") returned -1
	[0086.293] lstrcmpiW (lpString1=".png", lpString2=".ELM") returned 1
	[0086.293] lstrcmpiW (lpString1=".pnm", lpString2=".ELM") returned 1
	[0086.293] lstrcmpiW (lpString1=".pot", lpString2=".ELM") returned 1
	[0086.294] lstrcmpiW (lpString1=".potm", lpString2="S.ELM") returned -1
	[0086.294] lstrcmpiW (lpString1=".potx", lpString2="S.ELM") returned -1
	[0086.294] lstrcmpiW (lpString1=".ppa", lpString2=".ELM") returned 1
	[0086.294] lstrcmpiW (lpString1=".ppam", lpString2="S.ELM") returned -1
	[0086.294] lstrcmpiW (lpString1=".ppm", lpString2=".ELM") returned 1
	[0086.294] lstrcmpiW (lpString1=".pps", lpString2=".ELM") returned 1
	[0086.294] lstrcmpiW (lpString1=".ppsm", lpString2="S.ELM") returned -1
	[0086.295] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1
	[0086.295] lstrcmpiW (lpString1=".pptm", lpString2="S.ELM") returned -1
	[0086.295] lstrcmpiW (lpString1=".pptx", lpString2="S.ELM") returned -1
	[0086.295] lstrcmpiW (lpString1=".prn", lpString2=".ELM") returned 1
	[0086.295] lstrcmpiW (lpString1=".ps", lpString2="ELM") returned -1
	[0086.295] lstrcmpiW (lpString1=".psb", lpString2=".ELM") returned 1
	[0086.295] lstrcmpiW (lpString1=".psd", lpString2=".ELM") returned 1
	[0086.296] lstrcmpiW (lpString1=".pst", lpString2=".ELM") returned 1
	[0086.296] lstrcmpiW (lpString1=".ptx", lpString2=".ELM") returned 1
	[0086.296] lstrcmpiW (lpString1=".pub", lpString2=".ELM") returned 1
	[0086.296] lstrcmpiW (lpString1=".pwm", lpString2=".ELM") returned 1
	[0086.296] lstrcmpiW (lpString1=".pxr", lpString2=".ELM") returned 1
	[0086.296] lstrcmpiW (lpString1=".py", lpString2="ELM") returned -1
	[0086.297] lstrcmpiW (lpString1=".qt", lpString2="ELM") returned -1
	[0086.297] lstrcmpiW (lpString1=".r3d", lpString2=".ELM") returned 1
	[0086.297] lstrcmpiW (lpString1=".raf", lpString2=".ELM") returned 1
	[0086.297] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1
	[0086.297] lstrcmpiW (lpString1=".raw", lpString2=".ELM") returned 1
	[0086.297] lstrcmpiW (lpString1=".rdf", lpString2=".ELM") returned 1

Thread:
	id = 15
	os_tid = 0x40c

	[0072.601] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x36140c8
	[0072.614] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x36240d0
	[0072.615] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c38
	[0072.615] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x331020
	[0072.615] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c50
	[0072.616] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3a50020
	[0072.618] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c68
	[0072.619] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330c68, Size=0x20) returned 0x339a88
	[0072.619] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c68
	[0072.619] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330c68, Size=0x20) returned 0x339ab0
	[0072.620] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.621] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.621] Wow64DisableWow64FsRedirection (in: OldValue=0x311ff58 | out: OldValue=0x311ff58*=0x0) returned 1
	[0072.621] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.622] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339a88 | out: hHeap=0x2e0000) returned 1
	[0072.622] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.622] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339ab0 | out: hHeap=0x2e0000) returned 1
	[0072.623] Sleep (dwMilliseconds=0x64) 
	[0073.279] Sleep (dwMilliseconds=0x64) 
	[0073.467] lstrlenW (lpString="BCD") returned 3
	[0073.467] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0073.467] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.467] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.468] lstrlenW (lpString=".doc") returned 4
	[0073.468] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0073.468] lstrlenW (lpString=".docx") returned 5
	[0073.468] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0073.468] lstrlenW (lpString=".pdf") returned 4
	[0073.468] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0073.469] lstrlenW (lpString=".xls") returned 4
	[0073.469] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0073.469] lstrlenW (lpString=".xlsx") returned 5
	[0073.469] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0073.469] lstrlenW (lpString=".ppt") returned 4
	[0073.469] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0073.469] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.470] lstrlenW (lpString=".zip") returned 4
	[0073.470] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0073.470] lstrlenW (lpString=".rar") returned 4
	[0073.470] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0073.470] lstrlenW (lpString=".bz2") returned 4
	[0073.470] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0073.470] lstrlenW (lpString=".7z") returned 3
	[0073.471] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0073.471] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.471] lstrlenW (lpString=".dbf") returned 4
	[0073.471] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0073.471] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.471] lstrlenW (lpString=".1cd") returned 4
	[0073.471] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0073.472] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.472] lstrlenW (lpString=".jpg") returned 4
	[0073.472] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0073.472] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.472] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.473] lstrlenW (lpString=".doc") returned 4
	[0073.473] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0073.473] lstrlenW (lpString=".docx") returned 5
	[0073.473] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0073.473] lstrlenW (lpString=".pdf") returned 4
	[0073.473] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0073.473] lstrlenW (lpString=".xls") returned 4
	[0073.474] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0073.474] lstrlenW (lpString=".xlsx") returned 5
	[0073.474] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0073.474] lstrlenW (lpString=".ppt") returned 4
	[0073.474] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0073.474] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.474] lstrlenW (lpString=".zip") returned 4
	[0073.475] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0073.475] lstrlenW (lpString=".rar") returned 4
	[0073.475] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0073.475] lstrlenW (lpString=".bz2") returned 4
	[0073.475] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0073.475] lstrlenW (lpString=".7z") returned 3
	[0073.476] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0073.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.476] lstrlenW (lpString=".dbf") returned 4
	[0073.476] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0073.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.477] lstrlenW (lpString=".1cd") returned 4
	[0073.477] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0073.477] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0073.477] lstrlenW (lpString=".jpg") returned 4
	[0073.477] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0073.478] lstrcmpiW (lpString1=".LOG1", lpString2=".lina") returned 1
	[0073.479] lstrlenW (lpString="BCD.LOG1") returned 8
	[0073.479] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0074.857] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=0) returned 1
	[0074.857] CloseHandle (hObject=0x190) returned 1
	[0074.857] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.858] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.858] lstrlenW (lpString=".doc") returned 4
	[0074.858] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0074.858] lstrlenW (lpString=".docx") returned 5
	[0074.858] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0074.858] lstrlenW (lpString=".pdf") returned 4
	[0074.859] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0074.859] lstrlenW (lpString=".xls") returned 4
	[0074.859] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0074.859] lstrlenW (lpString=".xlsx") returned 5
	[0074.859] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0074.859] lstrlenW (lpString=".ppt") returned 4
	[0074.860] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0074.860] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.860] lstrlenW (lpString=".zip") returned 4
	[0074.860] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0074.860] lstrlenW (lpString=".rar") returned 4
	[0074.860] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0074.861] lstrlenW (lpString=".bz2") returned 4
	[0074.861] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0074.861] lstrlenW (lpString=".7z") returned 3
	[0074.861] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0074.861] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.861] lstrlenW (lpString=".dbf") returned 4
	[0074.861] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0074.862] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.862] lstrlenW (lpString=".1cd") returned 4
	[0074.862] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0074.862] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.862] lstrlenW (lpString=".jpg") returned 4
	[0074.862] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0074.863] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.863] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.863] lstrlenW (lpString=".doc") returned 4
	[0074.863] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0074.864] lstrlenW (lpString=".docx") returned 5
	[0074.864] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0074.864] lstrlenW (lpString=".pdf") returned 4
	[0074.864] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0074.864] lstrlenW (lpString=".xls") returned 4
	[0074.864] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0074.865] lstrlenW (lpString=".xlsx") returned 5
	[0074.865] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0074.865] lstrlenW (lpString=".ppt") returned 4
	[0074.865] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0074.865] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.865] lstrlenW (lpString=".zip") returned 4
	[0074.866] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0074.866] lstrlenW (lpString=".rar") returned 4
	[0074.866] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0074.866] lstrlenW (lpString=".bz2") returned 4
	[0074.866] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0074.866] lstrlenW (lpString=".7z") returned 3
	[0074.866] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0074.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.867] lstrlenW (lpString=".dbf") returned 4
	[0074.867] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0074.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.867] lstrlenW (lpString=".1cd") returned 4
	[0074.867] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0074.868] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0074.868] lstrlenW (lpString=".jpg") returned 4
	[0074.868] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0074.869] Sleep (dwMilliseconds=0x64) 
	[0075.045] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0075.045] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.045] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0075.046] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=91712) returned 1
	[0075.046] CloseHandle (hObject=0x19c) returned 1
	[0075.046] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0075.046] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0075.047] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.047] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.047] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.047] lstrlenW (lpString=".doc") returned 4
	[0075.047] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.047] lstrlenW (lpString=".docx") returned 5
	[0075.048] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.048] lstrlenW (lpString=".pdf") returned 4
	[0075.048] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.048] lstrlenW (lpString=".xls") returned 4
	[0075.048] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.048] lstrlenW (lpString=".xlsx") returned 5
	[0075.048] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.049] lstrlenW (lpString=".ppt") returned 4
	[0075.049] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.049] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.049] lstrlenW (lpString=".zip") returned 4
	[0075.049] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.049] lstrlenW (lpString=".rar") returned 4
	[0075.049] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.049] lstrlenW (lpString=".bz2") returned 4
	[0075.050] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.050] lstrlenW (lpString=".7z") returned 3
	[0075.050] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.050] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.050] lstrlenW (lpString=".dbf") returned 4
	[0075.050] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.050] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.051] lstrlenW (lpString=".1cd") returned 4
	[0075.051] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.051] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.051] lstrlenW (lpString=".jpg") returned 4
	[0075.051] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.052] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.052] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.052] lstrlenW (lpString=".doc") returned 4
	[0075.052] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.053] lstrlenW (lpString=".docx") returned 5
	[0075.053] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.053] lstrlenW (lpString=".pdf") returned 4
	[0075.053] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.053] lstrlenW (lpString=".xls") returned 4
	[0075.053] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.053] lstrlenW (lpString=".xlsx") returned 5
	[0075.054] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.054] lstrlenW (lpString=".ppt") returned 4
	[0075.054] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.054] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.054] lstrlenW (lpString=".zip") returned 4
	[0075.054] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.054] lstrlenW (lpString=".rar") returned 4
	[0075.055] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.055] lstrlenW (lpString=".bz2") returned 4
	[0075.055] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.055] lstrlenW (lpString=".7z") returned 3
	[0075.055] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.055] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.055] lstrlenW (lpString=".dbf") returned 4
	[0075.055] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.056] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.056] lstrlenW (lpString=".1cd") returned 4
	[0075.056] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.056] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0075.056] lstrlenW (lpString=".jpg") returned 4
	[0075.056] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.057] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0075.057] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.058] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0075.106] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=94800) returned 1
	[0075.106] CloseHandle (hObject=0x194) returned 1
	[0075.106] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0075.106] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0075.107] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.107] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.107] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.107] lstrlenW (lpString=".doc") returned 4
	[0075.107] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.108] lstrlenW (lpString=".docx") returned 5
	[0075.108] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.108] lstrlenW (lpString=".pdf") returned 4
	[0075.108] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.108] lstrlenW (lpString=".xls") returned 4
	[0075.109] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.109] lstrlenW (lpString=".xlsx") returned 5
	[0075.109] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.109] lstrlenW (lpString=".ppt") returned 4
	[0075.109] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.109] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.109] lstrlenW (lpString=".zip") returned 4
	[0075.110] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.110] lstrlenW (lpString=".rar") returned 4
	[0075.110] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.110] lstrlenW (lpString=".bz2") returned 4
	[0075.110] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.110] lstrlenW (lpString=".7z") returned 3
	[0075.111] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.111] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.111] lstrlenW (lpString=".dbf") returned 4
	[0075.111] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.111] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.111] lstrlenW (lpString=".1cd") returned 4
	[0075.112] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.112] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.112] lstrlenW (lpString=".jpg") returned 4
	[0075.112] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.113] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.113] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.113] lstrlenW (lpString=".doc") returned 4
	[0075.113] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.113] lstrlenW (lpString=".docx") returned 5
	[0075.113] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.114] lstrlenW (lpString=".pdf") returned 4
	[0075.114] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.114] lstrlenW (lpString=".xls") returned 4
	[0075.114] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.115] lstrlenW (lpString=".xlsx") returned 5
	[0075.115] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.115] lstrlenW (lpString=".ppt") returned 4
	[0075.116] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.116] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.116] lstrlenW (lpString=".zip") returned 4
	[0075.116] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.116] lstrlenW (lpString=".rar") returned 4
	[0075.116] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.117] lstrlenW (lpString=".bz2") returned 4
	[0075.117] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.117] lstrlenW (lpString=".7z") returned 3
	[0075.117] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.117] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.117] lstrlenW (lpString=".dbf") returned 4
	[0075.118] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.118] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.118] lstrlenW (lpString=".1cd") returned 4
	[0075.118] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.118] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0075.118] lstrlenW (lpString=".jpg") returned 4
	[0075.118] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.120] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0075.120] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.120] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0075.120] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=85056) returned 1
	[0075.121] CloseHandle (hObject=0x194) returned 1
	[0075.121] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20
	[0075.121] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0075.121] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.122] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.122] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.122] lstrlenW (lpString=".doc") returned 4
	[0075.122] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.122] lstrlenW (lpString=".docx") returned 5
	[0075.123] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.123] lstrlenW (lpString=".pdf") returned 4
	[0075.123] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.123] lstrlenW (lpString=".xls") returned 4
	[0075.123] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.123] lstrlenW (lpString=".xlsx") returned 5
	[0075.124] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.124] lstrlenW (lpString=".ppt") returned 4
	[0075.124] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.124] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.124] lstrlenW (lpString=".zip") returned 4
	[0075.124] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.125] lstrlenW (lpString=".rar") returned 4
	[0075.125] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.125] lstrlenW (lpString=".bz2") returned 4
	[0075.125] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.125] lstrlenW (lpString=".7z") returned 3
	[0075.125] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.125] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.126] lstrlenW (lpString=".dbf") returned 4
	[0075.126] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.126] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.126] lstrlenW (lpString=".1cd") returned 4
	[0075.126] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.126] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.127] lstrlenW (lpString=".jpg") returned 4
	[0075.127] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.127] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.127] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.128] lstrlenW (lpString=".doc") returned 4
	[0075.128] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.128] lstrlenW (lpString=".docx") returned 5
	[0075.128] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.128] lstrlenW (lpString=".pdf") returned 4
	[0075.128] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.129] lstrlenW (lpString=".xls") returned 4
	[0075.129] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.129] lstrlenW (lpString=".xlsx") returned 5
	[0075.129] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.129] lstrlenW (lpString=".ppt") returned 4
	[0075.129] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.129] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.130] lstrlenW (lpString=".zip") returned 4
	[0075.130] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.218] lstrlenW (lpString=".rar") returned 4
	[0075.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.218] lstrlenW (lpString=".bz2") returned 4
	[0075.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.218] lstrlenW (lpString=".7z") returned 3
	[0075.219] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.219] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.219] lstrlenW (lpString=".dbf") returned 4
	[0075.219] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.219] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.219] lstrlenW (lpString=".1cd") returned 4
	[0075.219] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.219] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0075.220] lstrlenW (lpString=".jpg") returned 4
	[0075.220] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.220] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0075.221] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0075.221] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0075.221] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=43600) returned 1
	[0075.221] CloseHandle (hObject=0x19c) returned 1
	[0075.222] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20
	[0075.222] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0075.222] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.222] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.222] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.222] lstrlenW (lpString=".doc") returned 4
	[0075.223] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.223] lstrlenW (lpString=".docx") returned 5
	[0075.223] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.223] lstrlenW (lpString=".pdf") returned 4
	[0075.223] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.223] lstrlenW (lpString=".xls") returned 4
	[0075.224] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.224] lstrlenW (lpString=".xlsx") returned 5
	[0075.224] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.224] lstrlenW (lpString=".ppt") returned 4
	[0075.224] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.225] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.225] lstrlenW (lpString=".zip") returned 4
	[0075.225] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.225] lstrlenW (lpString=".rar") returned 4
	[0075.225] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.225] lstrlenW (lpString=".bz2") returned 4
	[0075.225] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.226] lstrlenW (lpString=".7z") returned 3
	[0075.226] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.226] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.226] lstrlenW (lpString=".dbf") returned 4
	[0075.226] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.226] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.227] lstrlenW (lpString=".1cd") returned 4
	[0075.227] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.227] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.227] lstrlenW (lpString=".jpg") returned 4
	[0075.227] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.228] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.228] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.228] lstrlenW (lpString=".doc") returned 4
	[0075.228] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.228] lstrlenW (lpString=".docx") returned 5
	[0075.229] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.229] lstrlenW (lpString=".pdf") returned 4
	[0075.229] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.229] lstrlenW (lpString=".xls") returned 4
	[0075.229] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.229] lstrlenW (lpString=".xlsx") returned 5
	[0075.230] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.230] lstrlenW (lpString=".ppt") returned 4
	[0075.230] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.230] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.230] lstrlenW (lpString=".zip") returned 4
	[0075.230] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.231] lstrlenW (lpString=".rar") returned 4
	[0075.231] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.231] lstrlenW (lpString=".bz2") returned 4
	[0075.231] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.232] lstrlenW (lpString=".7z") returned 3
	[0075.232] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.232] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.232] lstrlenW (lpString=".dbf") returned 4
	[0075.232] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.232] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.233] lstrlenW (lpString=".1cd") returned 4
	[0075.233] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.233] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0075.233] lstrlenW (lpString=".jpg") returned 4
	[0075.233] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.234] Sleep (dwMilliseconds=0x64) 
	[0075.585] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0075.585] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.585] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0075.586] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=90192) returned 1
	[0075.586] CloseHandle (hObject=0x190) returned 1
	[0075.586] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20
	[0075.587] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0075.587] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.587] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.587] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.588] lstrlenW (lpString=".doc") returned 4
	[0075.588] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.588] lstrlenW (lpString=".docx") returned 5
	[0075.588] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.588] lstrlenW (lpString=".pdf") returned 4
	[0075.588] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.589] lstrlenW (lpString=".xls") returned 4
	[0075.589] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.589] lstrlenW (lpString=".xlsx") returned 5
	[0075.589] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.589] lstrlenW (lpString=".ppt") returned 4
	[0075.589] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.590] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.590] lstrlenW (lpString=".zip") returned 4
	[0075.590] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.590] lstrlenW (lpString=".rar") returned 4
	[0075.590] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.590] lstrlenW (lpString=".bz2") returned 4
	[0075.591] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.591] lstrlenW (lpString=".7z") returned 3
	[0075.591] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.591] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.591] lstrlenW (lpString=".dbf") returned 4
	[0075.591] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.592] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.592] lstrlenW (lpString=".1cd") returned 4
	[0075.592] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.592] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.592] lstrlenW (lpString=".jpg") returned 4
	[0075.593] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.593] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.593] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.593] lstrlenW (lpString=".doc") returned 4
	[0075.594] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.594] lstrlenW (lpString=".docx") returned 5
	[0075.594] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.594] lstrlenW (lpString=".pdf") returned 4
	[0075.594] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.594] lstrlenW (lpString=".xls") returned 4
	[0075.594] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.595] lstrlenW (lpString=".xlsx") returned 5
	[0075.595] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.595] lstrlenW (lpString=".ppt") returned 4
	[0075.595] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.595] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.595] lstrlenW (lpString=".zip") returned 4
	[0075.596] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.596] lstrlenW (lpString=".rar") returned 4
	[0075.596] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.596] lstrlenW (lpString=".bz2") returned 4
	[0075.596] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.597] lstrlenW (lpString=".7z") returned 3
	[0075.597] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.597] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.597] lstrlenW (lpString=".dbf") returned 4
	[0075.597] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.598] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.598] lstrlenW (lpString=".1cd") returned 4
	[0075.598] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.599] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0075.599] lstrlenW (lpString=".jpg") returned 4
	[0075.599] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.600] Sleep (dwMilliseconds=0x64) 
	[0075.821] Sleep (dwMilliseconds=0x64) 
	[0076.101] Sleep (dwMilliseconds=0x64) 
	[0076.499] lstrcmpiW (lpString1=".ttf", lpString2=".lina") returned 1
	[0076.499] lstrlenW (lpString="chs_boot.ttf") returned 12
	[0076.500] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.500] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=3694080) returned 1
	[0076.500] CloseHandle (hObject=0x194) returned 1
	[0076.501] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20
	[0076.501] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.501] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0076.502] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.502] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.502] lstrlenW (lpString=".doc") returned 4
	[0076.502] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.502] lstrlenW (lpString=".docx") returned 5
	[0076.502] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.503] lstrlenW (lpString=".pdf") returned 4
	[0076.503] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.503] lstrlenW (lpString=".xls") returned 4
	[0076.503] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.503] lstrlenW (lpString=".xlsx") returned 5
	[0076.503] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.504] lstrlenW (lpString=".ppt") returned 4
	[0076.504] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.504] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.504] lstrlenW (lpString=".zip") returned 4
	[0076.504] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.504] lstrlenW (lpString=".rar") returned 4
	[0076.504] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.505] lstrlenW (lpString=".bz2") returned 4
	[0076.505] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.505] lstrlenW (lpString=".7z") returned 3
	[0076.505] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.505] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.505] lstrlenW (lpString=".dbf") returned 4
	[0076.506] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.506] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.506] lstrlenW (lpString=".1cd") returned 4
	[0076.506] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.506] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.506] lstrlenW (lpString=".jpg") returned 4
	[0076.506] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.507] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.507] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.507] lstrlenW (lpString=".doc") returned 4
	[0076.508] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.508] lstrlenW (lpString=".docx") returned 5
	[0076.508] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.508] lstrlenW (lpString=".pdf") returned 4
	[0076.508] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.508] lstrlenW (lpString=".xls") returned 4
	[0076.509] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.509] lstrlenW (lpString=".xlsx") returned 5
	[0076.509] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.509] lstrlenW (lpString=".ppt") returned 4
	[0076.509] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.509] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.510] lstrlenW (lpString=".zip") returned 4
	[0076.510] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.510] lstrlenW (lpString=".rar") returned 4
	[0076.510] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.510] lstrlenW (lpString=".bz2") returned 4
	[0076.510] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.511] lstrlenW (lpString=".7z") returned 3
	[0076.511] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.511] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.511] lstrlenW (lpString=".dbf") returned 4
	[0076.511] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.512] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.512] lstrlenW (lpString=".1cd") returned 4
	[0076.512] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.512] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0076.512] lstrlenW (lpString=".jpg") returned 4
	[0076.512] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.513] lstrcmpiW (lpString1=".ttf", lpString2=".lina") returned 1
	[0076.514] lstrlenW (lpString="cht_boot.ttf") returned 12
	[0076.514] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.572] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=3876772) returned 1
	[0076.572] CloseHandle (hObject=0x190) returned 1
	[0076.573] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20
	[0076.573] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.573] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0076.574] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.574] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.574] lstrlenW (lpString=".doc") returned 4
	[0076.574] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.574] lstrlenW (lpString=".docx") returned 5
	[0076.574] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.574] lstrlenW (lpString=".pdf") returned 4
	[0076.575] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.575] lstrlenW (lpString=".xls") returned 4
	[0076.575] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.575] lstrlenW (lpString=".xlsx") returned 5
	[0076.575] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.575] lstrlenW (lpString=".ppt") returned 4
	[0076.576] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.576] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.576] lstrlenW (lpString=".zip") returned 4
	[0076.576] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.576] lstrlenW (lpString=".rar") returned 4
	[0076.576] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.576] lstrlenW (lpString=".bz2") returned 4
	[0076.577] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.577] lstrlenW (lpString=".7z") returned 3
	[0076.577] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.577] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.577] lstrlenW (lpString=".dbf") returned 4
	[0076.577] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.578] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.578] lstrlenW (lpString=".1cd") returned 4
	[0076.578] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.578] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.578] lstrlenW (lpString=".jpg") returned 4
	[0076.578] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.579] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.579] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.579] lstrlenW (lpString=".doc") returned 4
	[0076.579] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.579] lstrlenW (lpString=".docx") returned 5
	[0076.579] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.579] lstrlenW (lpString=".pdf") returned 4
	[0076.580] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.580] lstrlenW (lpString=".xls") returned 4
	[0076.580] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.580] lstrlenW (lpString=".xlsx") returned 5
	[0076.580] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.580] lstrlenW (lpString=".ppt") returned 4
	[0076.580] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.581] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.581] lstrlenW (lpString=".zip") returned 4
	[0076.581] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.581] lstrlenW (lpString=".rar") returned 4
	[0076.582] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.582] lstrlenW (lpString=".bz2") returned 4
	[0076.582] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.582] lstrlenW (lpString=".7z") returned 3
	[0076.582] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.582] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.582] lstrlenW (lpString=".dbf") returned 4
	[0076.583] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.583] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.583] lstrlenW (lpString=".1cd") returned 4
	[0076.583] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.583] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0076.583] lstrlenW (lpString=".jpg") returned 4
	[0076.583] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.584] lstrcmpiW (lpString1=".ttf", lpString2=".lina") returned 1
	[0076.584] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0076.585] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.585] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=1984228) returned 1
	[0076.585] CloseHandle (hObject=0x190) returned 1
	[0076.586] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0076.586] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.586] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0076.586] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.587] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.587] lstrlenW (lpString=".doc") returned 4
	[0076.587] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.587] lstrlenW (lpString=".docx") returned 5
	[0076.587] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.587] lstrlenW (lpString=".pdf") returned 4
	[0076.588] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.588] lstrlenW (lpString=".xls") returned 4
	[0076.588] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.588] lstrlenW (lpString=".xlsx") returned 5
	[0076.588] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.588] lstrlenW (lpString=".ppt") returned 4
	[0076.589] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.589] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.589] lstrlenW (lpString=".zip") returned 4
	[0076.589] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.589] lstrlenW (lpString=".rar") returned 4
	[0076.589] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.589] lstrlenW (lpString=".bz2") returned 4
	[0076.590] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.590] lstrlenW (lpString=".7z") returned 3
	[0076.590] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.590] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.590] lstrlenW (lpString=".dbf") returned 4
	[0076.590] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.590] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.591] lstrlenW (lpString=".1cd") returned 4
	[0076.591] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.591] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.591] lstrlenW (lpString=".jpg") returned 4
	[0076.591] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.592] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.592] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.592] lstrlenW (lpString=".doc") returned 4
	[0076.592] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.592] lstrlenW (lpString=".docx") returned 5
	[0076.592] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.593] lstrlenW (lpString=".pdf") returned 4
	[0076.593] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.593] lstrlenW (lpString=".xls") returned 4
	[0076.593] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.593] lstrlenW (lpString=".xlsx") returned 5
	[0076.593] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.593] lstrlenW (lpString=".ppt") returned 4
	[0076.594] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.594] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.594] lstrlenW (lpString=".zip") returned 4
	[0076.594] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.594] lstrlenW (lpString=".rar") returned 4
	[0076.594] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.594] lstrlenW (lpString=".bz2") returned 4
	[0076.595] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.595] lstrlenW (lpString=".7z") returned 3
	[0076.595] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.595] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.595] lstrlenW (lpString=".dbf") returned 4
	[0076.595] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.596] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.596] lstrlenW (lpString=".1cd") returned 4
	[0076.598] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.829] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0076.829] lstrlenW (lpString=".jpg") returned 4
	[0076.830] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.830] Sleep (dwMilliseconds=0x64) 
	[0077.106] lstrcmpiW (lpString1=".sys", lpString2=".lina") returned 1
	[0077.107] lstrlenW (lpString="hiberfil.sys") returned 12
	[0077.107] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.107] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.107] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.107] lstrlenW (lpString=".doc") returned 4
	[0077.108] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0077.108] lstrlenW (lpString=".docx") returned 5
	[0077.108] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0077.108] lstrlenW (lpString=".pdf") returned 4
	[0077.108] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0077.108] lstrlenW (lpString=".xls") returned 4
	[0077.108] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0077.109] lstrlenW (lpString=".xlsx") returned 5
	[0077.109] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0077.109] lstrlenW (lpString=".ppt") returned 4
	[0077.109] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0077.109] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.109] lstrlenW (lpString=".zip") returned 4
	[0077.109] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0077.110] lstrlenW (lpString=".rar") returned 4
	[0077.110] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0077.110] lstrlenW (lpString=".bz2") returned 4
	[0077.110] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0077.110] lstrlenW (lpString=".7z") returned 3
	[0077.110] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0077.110] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.111] lstrlenW (lpString=".dbf") returned 4
	[0077.111] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0077.111] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.111] lstrlenW (lpString=".1cd") returned 4
	[0077.112] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0077.112] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.112] lstrlenW (lpString=".jpg") returned 4
	[0077.112] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0077.112] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.113] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.113] lstrlenW (lpString=".doc") returned 4
	[0077.113] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0077.113] lstrlenW (lpString=".docx") returned 5
	[0077.113] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0077.113] lstrlenW (lpString=".pdf") returned 4
	[0077.114] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0077.114] lstrlenW (lpString=".xls") returned 4
	[0077.114] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0077.114] lstrlenW (lpString=".xlsx") returned 5
	[0077.114] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0077.114] lstrlenW (lpString=".ppt") returned 4
	[0077.115] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0077.115] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.115] lstrlenW (lpString=".zip") returned 4
	[0077.115] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0077.115] lstrlenW (lpString=".rar") returned 4
	[0077.115] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0077.115] lstrlenW (lpString=".bz2") returned 4
	[0077.116] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0077.116] lstrlenW (lpString=".7z") returned 3
	[0077.116] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0077.116] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.116] lstrlenW (lpString=".dbf") returned 4
	[0077.116] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0077.117] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.117] lstrlenW (lpString=".1cd") returned 4
	[0077.117] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0077.117] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0077.117] lstrlenW (lpString=".jpg") returned 4
	[0077.117] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0077.118] Sleep (dwMilliseconds=0x64) 
	[0077.585] Sleep (dwMilliseconds=0x64) 
	[0077.859] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0077.859] lstrlenW (lpString="ExcelMUI.msi") returned 12
	[0077.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0077.860] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=2506240) returned 1
	[0077.861] CloseHandle (hObject=0x1d8) returned 1
	[0077.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020
	[0077.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.861] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0077.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0077.863] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0077.863] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.863] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.871] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.874] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.892] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0077.892] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.892] ReadFile (in: hFile=0x1d8, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.070] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.071] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0078.370] SetEndOfFile (hFile=0x1d8) returned 1
	[0078.371] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ec3fd0
	[0078.371] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.371] WriteFile (in: hFile=0x1d8, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.374] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.374] WriteFile (in: hFile=0x1d8, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.384] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.384] WriteFile (in: hFile=0x1d8, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.389] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ec3fd0 | out: hHeap=0x2e0000) returned 1
	[0078.390] CloseHandle (hObject=0x1d8) returned 1
	[0079.479] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0079.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.481] lstrlenW (lpString=".doc") returned 4
	[0079.481] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.481] lstrlenW (lpString=".docx") returned 5
	[0079.481] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0079.481] lstrlenW (lpString=".pdf") returned 4
	[0079.482] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.482] lstrlenW (lpString=".xls") returned 4
	[0079.482] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.483] lstrlenW (lpString=".xlsx") returned 5
	[0079.483] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0079.483] lstrlenW (lpString=".ppt") returned 4
	[0079.483] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.484] lstrlenW (lpString=".zip") returned 4
	[0079.484] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.484] lstrlenW (lpString=".rar") returned 4
	[0079.484] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.484] lstrlenW (lpString=".bz2") returned 4
	[0079.485] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.485] lstrlenW (lpString=".7z") returned 3
	[0079.485] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.485] lstrlenW (lpString=".dbf") returned 4
	[0079.486] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.486] lstrlenW (lpString=".1cd") returned 4
	[0079.486] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.487] lstrlenW (lpString=".jpg") returned 4
	[0079.487] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.488] lstrlenW (lpString=".doc") returned 4
	[0079.488] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0079.488] lstrlenW (lpString=".docx") returned 5
	[0079.488] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0079.488] lstrlenW (lpString=".pdf") returned 4
	[0079.488] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0079.489] lstrlenW (lpString=".xls") returned 4
	[0079.489] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0079.489] lstrlenW (lpString=".xlsx") returned 5
	[0079.489] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0079.489] lstrlenW (lpString=".ppt") returned 4
	[0079.490] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0079.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.490] lstrlenW (lpString=".zip") returned 4
	[0079.490] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0079.490] lstrlenW (lpString=".rar") returned 4
	[0079.490] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0079.491] lstrlenW (lpString=".bz2") returned 4
	[0079.491] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0079.491] lstrlenW (lpString=".7z") returned 3
	[0079.491] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0079.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.492] lstrlenW (lpString=".dbf") returned 4
	[0079.492] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0079.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.492] lstrlenW (lpString=".1cd") returned 4
	[0079.492] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0079.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0079.493] lstrlenW (lpString=".jpg") returned 4
	[0079.493] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0079.494] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0079.494] lstrlenW (lpString="PublisherMUI.msi") returned 16
	[0079.494] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0079.495] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=2513920) returned 1
	[0079.495] CloseHandle (hObject=0x1d8) returned 1
	[0079.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020
	[0079.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0079.496] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0079.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0079.498] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0079.498] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.499] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0079.918] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.918] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0079.933] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0079.934] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0079.934] ReadFile (in: hFile=0x1d8, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.140] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.140] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc010c, lpOverlapped=0x0) returned 1
	[0080.291] SetEndOfFile (hFile=0x1d8) returned 1
	[0080.291] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f23fe8
	[0080.337] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.337] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f23fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.479] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.479] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f23fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.489] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0080.489] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f23fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0080.494] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f23fe8 | out: hHeap=0x2e0000) returned 1
	[0080.494] CloseHandle (hObject=0x1d8) returned 1
	[0081.484] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0081.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.485] lstrlenW (lpString=".doc") returned 4
	[0081.485] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.485] lstrlenW (lpString=".docx") returned 5
	[0081.485] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.486] lstrlenW (lpString=".pdf") returned 4
	[0081.486] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.486] lstrlenW (lpString=".xls") returned 4
	[0081.486] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.486] lstrlenW (lpString=".xlsx") returned 5
	[0081.486] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.486] lstrlenW (lpString=".ppt") returned 4
	[0081.487] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.487] lstrlenW (lpString=".zip") returned 4
	[0081.487] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.487] lstrlenW (lpString=".rar") returned 4
	[0081.487] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.487] lstrlenW (lpString=".bz2") returned 4
	[0081.488] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.488] lstrlenW (lpString=".7z") returned 3
	[0081.488] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.488] lstrlenW (lpString=".dbf") returned 4
	[0081.488] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.489] lstrlenW (lpString=".1cd") returned 4
	[0081.489] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.489] lstrlenW (lpString=".jpg") returned 4
	[0081.489] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.490] lstrlenW (lpString=".doc") returned 4
	[0081.490] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0081.490] lstrlenW (lpString=".docx") returned 5
	[0081.490] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0081.491] lstrlenW (lpString=".pdf") returned 4
	[0081.491] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0081.491] lstrlenW (lpString=".xls") returned 4
	[0081.491] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0081.491] lstrlenW (lpString=".xlsx") returned 5
	[0081.491] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0081.492] lstrlenW (lpString=".ppt") returned 4
	[0081.492] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0081.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.492] lstrlenW (lpString=".zip") returned 4
	[0081.492] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0081.492] lstrlenW (lpString=".rar") returned 4
	[0081.492] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0081.493] lstrlenW (lpString=".bz2") returned 4
	[0081.493] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0081.493] lstrlenW (lpString=".7z") returned 3
	[0081.493] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0081.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.493] lstrlenW (lpString=".dbf") returned 4
	[0081.494] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0081.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.494] lstrlenW (lpString=".1cd") returned 4
	[0081.494] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0081.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0081.494] lstrlenW (lpString=".jpg") returned 4
	[0081.494] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0081.495] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0081.496] lstrlenW (lpString="OutlkLR.cab") returned 11
	[0081.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0081.496] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=14819276) returned 1
	[0081.497] CloseHandle (hObject=0x1d8) returned 1
	[0081.497] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020
	[0081.497] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0081.497] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0081.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0081.499] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0081.499] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0081.499] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.548] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.548] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.603] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.604] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.604] ReadFile (in: hFile=0x1d8, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0084.898] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0084.898] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0085.773] SetEndOfFile (hFile=0x1d8) returned 1
	[0085.774] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f64ff8
	[0085.774] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.774] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.776] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.776] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.777] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0085.777] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0085.779] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f64ff8 | out: hHeap=0x2e0000) returned 1
	[0085.779] CloseHandle (hObject=0x1d8) returned 1
	[0087.186] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0087.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.187] lstrlenW (lpString=".doc") returned 4
	[0087.187] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0087.187] lstrlenW (lpString=".docx") returned 5
	[0087.187] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0087.187] lstrlenW (lpString=".pdf") returned 4
	[0087.187] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0087.187] lstrlenW (lpString=".xls") returned 4
	[0087.187] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0087.188] lstrlenW (lpString=".xlsx") returned 5
	[0087.188] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0087.188] lstrlenW (lpString=".ppt") returned 4
	[0087.188] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0087.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.188] lstrlenW (lpString=".zip") returned 4
	[0087.188] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0087.188] lstrlenW (lpString=".rar") returned 4
	[0087.188] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0087.189] lstrlenW (lpString=".bz2") returned 4
	[0087.189] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0087.189] lstrlenW (lpString=".7z") returned 3
	[0087.189] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0087.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.189] lstrlenW (lpString=".dbf") returned 4
	[0087.189] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0087.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.190] lstrlenW (lpString=".1cd") returned 4
	[0087.190] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0087.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.190] lstrlenW (lpString=".jpg") returned 4
	[0087.191] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0087.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.191] lstrlenW (lpString=".doc") returned 4
	[0087.191] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0087.191] lstrlenW (lpString=".docx") returned 5
	[0087.191] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0087.191] lstrlenW (lpString=".pdf") returned 4
	[0087.192] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0087.192] lstrlenW (lpString=".xls") returned 4
	[0087.192] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0087.192] lstrlenW (lpString=".xlsx") returned 5
	[0087.192] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0087.192] lstrlenW (lpString=".ppt") returned 4
	[0087.192] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0087.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.192] lstrlenW (lpString=".zip") returned 4
	[0087.192] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0087.193] lstrlenW (lpString=".rar") returned 4
	[0087.193] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0087.193] lstrlenW (lpString=".bz2") returned 4
	[0087.193] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0087.193] lstrlenW (lpString=".7z") returned 3
	[0087.193] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0087.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.193] lstrlenW (lpString=".dbf") returned 4
	[0087.193] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0087.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.193] lstrlenW (lpString=".1cd") returned 4
	[0087.194] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0087.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0087.194] lstrlenW (lpString=".jpg") returned 4
	[0087.194] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0087.194] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0087.195] lstrlenW (lpString="Proof.cab") returned 9
	[0087.195] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0089.810] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=13642474) returned 1
	[0089.810] CloseHandle (hObject=0x1c8) returned 1
	[0089.811] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020
	[0089.811] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0089.811] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0091.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8
	[0091.373] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0091.374] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0091.374] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0092.684] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0092.684] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0093.343] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0093.343] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0093.343] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0094.488] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0094.488] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x311fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0095.285] SetEndOfFile (hFile=0x1c8) returned 1
	[0095.285] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fa4000
	[0095.640] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.640] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fa4000*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4000*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.642] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.642] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fa4000*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4000*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.645] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x311fc7c | out: lpNewFilePointer=0x0) returned 1
	[0095.645] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fa4000*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4000*, lpNumberOfBytesWritten=0x311fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0095.648] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fa4000 | out: hHeap=0x2e0000) returned 1
	[0095.648] CloseHandle (hObject=0x1c8) returned 1
	[0099.182] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0099.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.183] lstrlenW (lpString=".doc") returned 4
	[0099.183] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.183] lstrlenW (lpString=".docx") returned 5
	[0099.183] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0099.184] lstrlenW (lpString=".pdf") returned 4
	[0099.184] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.184] lstrlenW (lpString=".xls") returned 4
	[0099.184] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.184] lstrlenW (lpString=".xlsx") returned 5
	[0099.184] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0099.185] lstrlenW (lpString=".ppt") returned 4
	[0099.185] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.185] lstrlenW (lpString=".zip") returned 4
	[0099.186] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.186] lstrlenW (lpString=".rar") returned 4
	[0099.186] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.186] lstrlenW (lpString=".bz2") returned 4
	[0099.186] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.186] lstrlenW (lpString=".7z") returned 3
	[0099.186] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.187] lstrlenW (lpString=".dbf") returned 4
	[0099.187] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.187] lstrlenW (lpString=".1cd") returned 4
	[0099.187] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.188] lstrlenW (lpString=".jpg") returned 4
	[0099.188] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.189] lstrlenW (lpString=".doc") returned 4
	[0099.189] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.189] lstrlenW (lpString=".docx") returned 5
	[0099.189] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0099.189] lstrlenW (lpString=".pdf") returned 4
	[0099.190] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.190] lstrlenW (lpString=".xls") returned 4
	[0099.190] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.190] lstrlenW (lpString=".xlsx") returned 5
	[0099.190] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0099.190] lstrlenW (lpString=".ppt") returned 4
	[0099.191] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.191] lstrlenW (lpString=".zip") returned 4
	[0099.191] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.191] lstrlenW (lpString=".rar") returned 4
	[0099.191] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.192] lstrlenW (lpString=".bz2") returned 4
	[0099.192] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.192] lstrlenW (lpString=".7z") returned 3
	[0099.192] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.192] lstrlenW (lpString=".dbf") returned 4
	[0099.193] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.193] lstrlenW (lpString=".1cd") returned 4
	[0099.193] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0099.193] lstrlenW (lpString=".jpg") returned 4
	[0099.194] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.195] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0099.195] lstrlenW (lpString="OnoteLR.cab") returned 11
	[0099.195] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0099.402] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x311ff1c | out: lpFileSize=0x311ff1c*=17456632) returned 1
	[0099.404] CloseHandle (hObject=0x200) returned 1
	[0099.404] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020
	[0099.404] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.404] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0099.405] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0099.406] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.406] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.406] ReadFile (in: hFile=0x200, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.536] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.536] ReadFile (in: hFile=0x200, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.614] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.614] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x311fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.615] ReadFile (in: hFile=0x200, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x311fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.674] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.675] WriteFile (hFile=0x200, lpBuffer=0x3a50020, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x311fcb0, lpOverlapped=0x0) 

Thread:
	id = 16
	os_tid = 0x124

	[0072.623] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x36342e8
	[0072.624] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x36442f0
	[0072.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c68
	[0072.625] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x331010
	[0072.626] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c80
	[0072.626] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3b60020
	[0072.628] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c98
	[0072.629] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330c98, Size=0x20) returned 0x339ab0
	[0072.629] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c98
	[0072.629] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330c98, Size=0x20) returned 0x339a88
	[0072.630] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.631] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.631] Wow64DisableWow64FsRedirection (in: OldValue=0x336ff58 | out: OldValue=0x336ff58*=0x0) returned 1
	[0072.631] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.631] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339ab0 | out: hHeap=0x2e0000) returned 1
	[0072.631] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.632] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339a88 | out: hHeap=0x2e0000) returned 1
	[0072.632] Sleep (dwMilliseconds=0x64) 
	[0073.280] Sleep (dwMilliseconds=0x64) 
	[0073.480] lstrcmpiW (lpString1=".LOG2", lpString2=".lina") returned 1
	[0073.480] lstrlenW (lpString="BCD.LOG2") returned 8
	[0073.480] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0074.841] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=0) returned 1
	[0074.842] CloseHandle (hObject=0x190) returned 1
	[0074.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.842] lstrlenW (lpString=".doc") returned 4
	[0074.842] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0074.843] lstrlenW (lpString=".docx") returned 5
	[0074.843] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0074.843] lstrlenW (lpString=".pdf") returned 4
	[0074.843] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0074.843] lstrlenW (lpString=".xls") returned 4
	[0074.844] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0074.844] lstrlenW (lpString=".xlsx") returned 5
	[0074.844] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0074.844] lstrlenW (lpString=".ppt") returned 4
	[0074.844] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0074.845] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.845] lstrlenW (lpString=".zip") returned 4
	[0074.845] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0074.845] lstrlenW (lpString=".rar") returned 4
	[0074.845] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0074.845] lstrlenW (lpString=".bz2") returned 4
	[0074.846] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0074.846] lstrlenW (lpString=".7z") returned 3
	[0074.846] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0074.846] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.846] lstrlenW (lpString=".dbf") returned 4
	[0074.847] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0074.847] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.847] lstrlenW (lpString=".1cd") returned 4
	[0074.847] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0074.847] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.847] lstrlenW (lpString=".jpg") returned 4
	[0074.848] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0074.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.848] lstrlenW (lpString=".doc") returned 4
	[0074.849] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0074.849] lstrlenW (lpString=".docx") returned 5
	[0074.850] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0074.850] lstrlenW (lpString=".pdf") returned 4
	[0074.850] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0074.850] lstrlenW (lpString=".xls") returned 4
	[0074.851] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0074.851] lstrlenW (lpString=".xlsx") returned 5
	[0074.851] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0074.851] lstrlenW (lpString=".ppt") returned 4
	[0074.851] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0074.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.852] lstrlenW (lpString=".zip") returned 4
	[0074.852] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0074.852] lstrlenW (lpString=".rar") returned 4
	[0074.852] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0074.852] lstrlenW (lpString=".bz2") returned 4
	[0074.853] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0074.853] lstrlenW (lpString=".7z") returned 3
	[0074.853] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0074.853] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.853] lstrlenW (lpString=".dbf") returned 4
	[0074.854] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0074.854] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.854] lstrlenW (lpString=".1cd") returned 4
	[0074.854] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0074.854] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0074.855] lstrlenW (lpString=".jpg") returned 4
	[0074.855] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0074.856] Sleep (dwMilliseconds=0x64) 
	[0074.959] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0074.959] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.959] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0074.960] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=89168) returned 1
	[0074.960] CloseHandle (hObject=0x198) returned 1
	[0074.960] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0074.961] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0074.961] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0074.961] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.961] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.961] lstrlenW (lpString=".doc") returned 4
	[0074.962] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.962] lstrlenW (lpString=".docx") returned 5
	[0074.962] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.962] lstrlenW (lpString=".pdf") returned 4
	[0074.962] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.962] lstrlenW (lpString=".xls") returned 4
	[0074.963] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.963] lstrlenW (lpString=".xlsx") returned 5
	[0074.963] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.963] lstrlenW (lpString=".ppt") returned 4
	[0074.963] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.963] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.963] lstrlenW (lpString=".zip") returned 4
	[0074.964] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.964] lstrlenW (lpString=".rar") returned 4
	[0074.964] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.964] lstrlenW (lpString=".bz2") returned 4
	[0074.964] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.964] lstrlenW (lpString=".7z") returned 3
	[0074.965] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.965] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.965] lstrlenW (lpString=".dbf") returned 4
	[0074.965] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.965] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.966] lstrlenW (lpString=".1cd") returned 4
	[0074.966] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.966] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.966] lstrlenW (lpString=".jpg") returned 4
	[0074.967] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.967] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.967] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.967] lstrlenW (lpString=".doc") returned 4
	[0074.968] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0074.968] lstrlenW (lpString=".docx") returned 5
	[0074.968] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0074.968] lstrlenW (lpString=".pdf") returned 4
	[0074.968] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0074.968] lstrlenW (lpString=".xls") returned 4
	[0074.969] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0074.969] lstrlenW (lpString=".xlsx") returned 5
	[0074.969] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0074.969] lstrlenW (lpString=".ppt") returned 4
	[0074.969] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0074.969] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.970] lstrlenW (lpString=".zip") returned 4
	[0074.970] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0074.970] lstrlenW (lpString=".rar") returned 4
	[0074.970] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0074.971] lstrlenW (lpString=".bz2") returned 4
	[0074.971] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0074.971] lstrlenW (lpString=".7z") returned 3
	[0074.971] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0074.971] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.971] lstrlenW (lpString=".dbf") returned 4
	[0074.972] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0074.972] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.972] lstrlenW (lpString=".1cd") returned 4
	[0074.972] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0074.972] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0074.972] lstrlenW (lpString=".jpg") returned 4
	[0074.973] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0074.974] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0074.975] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0074.975] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0075.060] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=87616) returned 1
	[0075.061] CloseHandle (hObject=0x19c) returned 1
	[0075.061] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0075.061] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0075.061] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.062] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.062] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.062] lstrlenW (lpString=".doc") returned 4
	[0075.062] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.062] lstrlenW (lpString=".docx") returned 5
	[0075.062] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.062] lstrlenW (lpString=".pdf") returned 4
	[0075.062] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.063] lstrlenW (lpString=".xls") returned 4
	[0075.063] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.063] lstrlenW (lpString=".xlsx") returned 5
	[0075.063] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.063] lstrlenW (lpString=".ppt") returned 4
	[0075.063] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.063] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.064] lstrlenW (lpString=".zip") returned 4
	[0075.064] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.064] lstrlenW (lpString=".rar") returned 4
	[0075.064] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.064] lstrlenW (lpString=".bz2") returned 4
	[0075.064] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.064] lstrlenW (lpString=".7z") returned 3
	[0075.064] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.065] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.065] lstrlenW (lpString=".dbf") returned 4
	[0075.065] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.065] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.065] lstrlenW (lpString=".1cd") returned 4
	[0075.065] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.065] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.066] lstrlenW (lpString=".jpg") returned 4
	[0075.066] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.066] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.066] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.066] lstrlenW (lpString=".doc") returned 4
	[0075.067] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.067] lstrlenW (lpString=".docx") returned 5
	[0075.067] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.067] lstrlenW (lpString=".pdf") returned 4
	[0075.067] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.068] lstrlenW (lpString=".xls") returned 4
	[0075.068] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.068] lstrlenW (lpString=".xlsx") returned 5
	[0075.068] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.068] lstrlenW (lpString=".ppt") returned 4
	[0075.068] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.069] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.069] lstrlenW (lpString=".zip") returned 4
	[0075.069] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.069] lstrlenW (lpString=".rar") returned 4
	[0075.069] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.069] lstrlenW (lpString=".bz2") returned 4
	[0075.070] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.070] lstrlenW (lpString=".7z") returned 3
	[0075.070] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.070] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.070] lstrlenW (lpString=".dbf") returned 4
	[0075.070] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.071] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.071] lstrlenW (lpString=".1cd") returned 4
	[0075.071] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.071] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0075.071] lstrlenW (lpString=".jpg") returned 4
	[0075.071] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.072] Sleep (dwMilliseconds=0x64) 
	[0075.273] Sleep (dwMilliseconds=0x64) 
	[0075.661] Sleep (dwMilliseconds=0x64) 
	[0075.911] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0075.911] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.911] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0075.912] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=89152) returned 1
	[0075.912] CloseHandle (hObject=0x1bc) returned 1
	[0075.912] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20
	[0075.913] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0075.913] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0075.913] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.913] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.914] lstrlenW (lpString=".doc") returned 4
	[0075.914] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.914] lstrlenW (lpString=".docx") returned 5
	[0075.914] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.914] lstrlenW (lpString=".pdf") returned 4
	[0075.915] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.915] lstrlenW (lpString=".xls") returned 4
	[0075.915] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.915] lstrlenW (lpString=".xlsx") returned 5
	[0075.915] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.916] lstrlenW (lpString=".ppt") returned 4
	[0075.916] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.916] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.916] lstrlenW (lpString=".zip") returned 4
	[0075.916] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.916] lstrlenW (lpString=".rar") returned 4
	[0075.917] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.917] lstrlenW (lpString=".bz2") returned 4
	[0075.917] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.917] lstrlenW (lpString=".7z") returned 3
	[0075.917] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.917] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.918] lstrlenW (lpString=".dbf") returned 4
	[0075.918] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.918] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.918] lstrlenW (lpString=".1cd") returned 4
	[0075.918] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.918] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.919] lstrlenW (lpString=".jpg") returned 4
	[0075.919] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.919] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.919] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.920] lstrlenW (lpString=".doc") returned 4
	[0075.920] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.920] lstrlenW (lpString=".docx") returned 5
	[0075.920] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.920] lstrlenW (lpString=".pdf") returned 4
	[0075.920] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.920] lstrlenW (lpString=".xls") returned 4
	[0075.921] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0075.921] lstrlenW (lpString=".xlsx") returned 5
	[0075.921] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0075.921] lstrlenW (lpString=".ppt") returned 4
	[0075.921] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.921] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.922] lstrlenW (lpString=".zip") returned 4
	[0075.922] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0075.922] lstrlenW (lpString=".rar") returned 4
	[0075.922] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.922] lstrlenW (lpString=".bz2") returned 4
	[0075.922] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.922] lstrlenW (lpString=".7z") returned 3
	[0075.923] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.923] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.923] lstrlenW (lpString=".dbf") returned 4
	[0075.923] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.923] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.923] lstrlenW (lpString=".1cd") returned 4
	[0075.924] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.924] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0075.924] lstrlenW (lpString=".jpg") returned 4
	[0075.924] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.925] Sleep (dwMilliseconds=0x64) 
	[0076.413] Sleep (dwMilliseconds=0x64) 
	[0076.599] lstrcmpiW (lpString1=".ttf", lpString2=".lina") returned 1
	[0076.599] lstrlenW (lpString="kor_boot.ttf") returned 12
	[0076.599] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.600] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2371360) returned 1
	[0076.600] CloseHandle (hObject=0x190) returned 1
	[0076.600] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0076.600] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.601] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0
	[0076.601] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.601] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.601] lstrlenW (lpString=".doc") returned 4
	[0076.602] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.602] lstrlenW (lpString=".docx") returned 5
	[0076.602] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.602] lstrlenW (lpString=".pdf") returned 4
	[0076.602] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.602] lstrlenW (lpString=".xls") returned 4
	[0076.602] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.603] lstrlenW (lpString=".xlsx") returned 5
	[0076.603] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.603] lstrlenW (lpString=".ppt") returned 4
	[0076.603] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.603] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.603] lstrlenW (lpString=".zip") returned 4
	[0076.604] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.604] lstrlenW (lpString=".rar") returned 4
	[0076.604] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.604] lstrlenW (lpString=".bz2") returned 4
	[0076.604] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.604] lstrlenW (lpString=".7z") returned 3
	[0076.605] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.605] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.605] lstrlenW (lpString=".dbf") returned 4
	[0076.605] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.605] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.605] lstrlenW (lpString=".1cd") returned 4
	[0076.605] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.606] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.606] lstrlenW (lpString=".jpg") returned 4
	[0076.606] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.606] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.607] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.607] lstrlenW (lpString=".doc") returned 4
	[0076.607] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.607] lstrlenW (lpString=".docx") returned 5
	[0076.607] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.607] lstrlenW (lpString=".pdf") returned 4
	[0076.607] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.608] lstrlenW (lpString=".xls") returned 4
	[0076.608] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.608] lstrlenW (lpString=".xlsx") returned 5
	[0076.608] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.608] lstrlenW (lpString=".ppt") returned 4
	[0076.608] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.609] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.609] lstrlenW (lpString=".zip") returned 4
	[0076.609] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.609] lstrlenW (lpString=".rar") returned 4
	[0076.609] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.609] lstrlenW (lpString=".bz2") returned 4
	[0076.609] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.610] lstrlenW (lpString=".7z") returned 3
	[0076.610] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.610] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.610] lstrlenW (lpString=".dbf") returned 4
	[0076.610] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.610] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.611] lstrlenW (lpString=".1cd") returned 4
	[0076.611] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.611] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0076.611] lstrlenW (lpString=".jpg") returned 4
	[0076.611] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.612] lstrcmpiW (lpString1=".ttf", lpString2=".lina") returned 1
	[0076.613] lstrlenW (lpString="wgl4_boot.ttf") returned 13
	[0076.613] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.613] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=47452) returned 1
	[0076.613] CloseHandle (hObject=0x190) returned 1
	[0076.614] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20
	[0076.614] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.614] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.614] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.615] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.615] lstrlenW (lpString=".doc") returned 4
	[0076.615] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.615] lstrlenW (lpString=".docx") returned 5
	[0076.615] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.615] lstrlenW (lpString=".pdf") returned 4
	[0076.616] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.616] lstrlenW (lpString=".xls") returned 4
	[0076.616] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.616] lstrlenW (lpString=".xlsx") returned 5
	[0076.616] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.616] lstrlenW (lpString=".ppt") returned 4
	[0076.616] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.617] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.617] lstrlenW (lpString=".zip") returned 4
	[0076.617] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.617] lstrlenW (lpString=".rar") returned 4
	[0076.617] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.617] lstrlenW (lpString=".bz2") returned 4
	[0076.618] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.618] lstrlenW (lpString=".7z") returned 3
	[0076.618] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.618] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.618] lstrlenW (lpString=".dbf") returned 4
	[0076.618] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.619] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.619] lstrlenW (lpString=".1cd") returned 4
	[0076.619] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.619] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.619] lstrlenW (lpString=".jpg") returned 4
	[0076.619] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.620] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.620] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.620] lstrlenW (lpString=".doc") returned 4
	[0076.620] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0076.620] lstrlenW (lpString=".docx") returned 5
	[0076.621] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0076.621] lstrlenW (lpString=".pdf") returned 4
	[0076.621] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.621] lstrlenW (lpString=".xls") returned 4
	[0076.621] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0076.621] lstrlenW (lpString=".xlsx") returned 5
	[0076.622] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0076.622] lstrlenW (lpString=".ppt") returned 4
	[0076.622] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.622] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.622] lstrlenW (lpString=".zip") returned 4
	[0076.622] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0076.623] lstrlenW (lpString=".rar") returned 4
	[0076.623] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.623] lstrlenW (lpString=".bz2") returned 4
	[0076.623] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0076.623] lstrlenW (lpString=".7z") returned 3
	[0076.623] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0076.623] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.624] lstrlenW (lpString=".dbf") returned 4
	[0076.624] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0076.624] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.624] lstrlenW (lpString=".1cd") returned 4
	[0076.624] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0076.624] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0076.625] lstrlenW (lpString=".jpg") returned 4
	[0076.625] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.626] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.626] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.626] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.627] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=93248) returned 1
	[0076.627] CloseHandle (hObject=0x190) returned 1
	[0076.627] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20
	[0076.627] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.627] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.628] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.628] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.628] lstrlenW (lpString=".doc") returned 4
	[0076.628] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.628] lstrlenW (lpString=".docx") returned 5
	[0076.629] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.629] lstrlenW (lpString=".pdf") returned 4
	[0076.629] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.629] lstrlenW (lpString=".xls") returned 4
	[0076.629] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.629] lstrlenW (lpString=".xlsx") returned 5
	[0076.630] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.630] lstrlenW (lpString=".ppt") returned 4
	[0076.630] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.630] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.630] lstrlenW (lpString=".zip") returned 4
	[0076.630] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.631] lstrlenW (lpString=".rar") returned 4
	[0076.631] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.631] lstrlenW (lpString=".bz2") returned 4
	[0076.631] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.631] lstrlenW (lpString=".7z") returned 3
	[0076.631] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.632] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.632] lstrlenW (lpString=".dbf") returned 4
	[0076.632] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.632] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.632] lstrlenW (lpString=".1cd") returned 4
	[0076.632] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.632] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.633] lstrlenW (lpString=".jpg") returned 4
	[0076.633] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.633] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.633] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.634] lstrlenW (lpString=".doc") returned 4
	[0076.634] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.634] lstrlenW (lpString=".docx") returned 5
	[0076.634] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.634] lstrlenW (lpString=".pdf") returned 4
	[0076.634] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.634] lstrlenW (lpString=".xls") returned 4
	[0076.634] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.635] lstrlenW (lpString=".xlsx") returned 5
	[0076.635] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.635] lstrlenW (lpString=".ppt") returned 4
	[0076.635] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.635] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.635] lstrlenW (lpString=".zip") returned 4
	[0076.635] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.636] lstrlenW (lpString=".rar") returned 4
	[0076.636] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.636] lstrlenW (lpString=".bz2") returned 4
	[0076.636] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.636] lstrlenW (lpString=".7z") returned 3
	[0076.636] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.636] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.637] lstrlenW (lpString=".dbf") returned 4
	[0076.637] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.637] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.637] lstrlenW (lpString=".1cd") returned 4
	[0076.637] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.637] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0076.638] lstrlenW (lpString=".jpg") returned 4
	[0076.638] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.639] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.639] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.639] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.640] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=90688) returned 1
	[0076.640] CloseHandle (hObject=0x190) returned 1
	[0076.640] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20
	[0076.640] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.641] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.641] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.641] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.641] lstrlenW (lpString=".doc") returned 4
	[0076.641] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.642] lstrlenW (lpString=".docx") returned 5
	[0076.642] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.642] lstrlenW (lpString=".pdf") returned 4
	[0076.642] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.642] lstrlenW (lpString=".xls") returned 4
	[0076.643] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.643] lstrlenW (lpString=".xlsx") returned 5
	[0076.643] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.831] lstrlenW (lpString=".ppt") returned 4
	[0076.831] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.831] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.831] lstrlenW (lpString=".zip") returned 4
	[0076.831] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.831] lstrlenW (lpString=".rar") returned 4
	[0076.832] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.832] lstrlenW (lpString=".bz2") returned 4
	[0076.832] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.832] lstrlenW (lpString=".7z") returned 3
	[0076.832] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.832] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.832] lstrlenW (lpString=".dbf") returned 4
	[0076.832] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.833] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.833] lstrlenW (lpString=".1cd") returned 4
	[0076.833] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.833] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.833] lstrlenW (lpString=".jpg") returned 4
	[0076.833] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.834] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.834] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.834] lstrlenW (lpString=".doc") returned 4
	[0076.834] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.834] lstrlenW (lpString=".docx") returned 5
	[0076.834] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.835] lstrlenW (lpString=".pdf") returned 4
	[0076.835] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.835] lstrlenW (lpString=".xls") returned 4
	[0076.835] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.835] lstrlenW (lpString=".xlsx") returned 5
	[0076.835] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.835] lstrlenW (lpString=".ppt") returned 4
	[0076.836] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.836] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.836] lstrlenW (lpString=".zip") returned 4
	[0076.836] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.836] lstrlenW (lpString=".rar") returned 4
	[0076.836] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.837] lstrlenW (lpString=".bz2") returned 4
	[0076.837] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.837] lstrlenW (lpString=".7z") returned 3
	[0076.837] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.837] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.837] lstrlenW (lpString=".dbf") returned 4
	[0076.837] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.838] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.838] lstrlenW (lpString=".1cd") returned 4
	[0076.838] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.838] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0076.838] lstrlenW (lpString=".jpg") returned 4
	[0076.838] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.839] Sleep (dwMilliseconds=0x64) 
	[0077.119] Sleep (dwMilliseconds=0x64) 
	[0077.586] Sleep (dwMilliseconds=0x64) 
	[0077.878] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0077.898] lstrlenW (lpString="PowerPointMUI.msi") returned 17
	[0077.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0077.899] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2503680) returned 1
	[0077.899] CloseHandle (hObject=0x1dc) returned 1
	[0077.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020
	[0077.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.900] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0077.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0077.902] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0077.902] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.902] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.910] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.911] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.932] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0077.932] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.932] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.156] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.157] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc010e, lpOverlapped=0x0) returned 1
	[0078.468] SetEndOfFile (hFile=0x1dc) returned 1
	[0078.470] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f23fe8
	[0078.479] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.480] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f23fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.483] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.483] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f23fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.494] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.494] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f23fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.814] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f23fe8 | out: hHeap=0x2e0000) returned 1
	[0078.814] CloseHandle (hObject=0x1dc) returned 1
	[0080.046] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0080.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.047] lstrlenW (lpString=".doc") returned 4
	[0080.047] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.047] lstrlenW (lpString=".docx") returned 5
	[0080.047] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0080.047] lstrlenW (lpString=".pdf") returned 4
	[0080.047] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.048] lstrlenW (lpString=".xls") returned 4
	[0080.048] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.048] lstrlenW (lpString=".xlsx") returned 5
	[0080.048] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0080.048] lstrlenW (lpString=".ppt") returned 4
	[0080.048] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.049] lstrlenW (lpString=".zip") returned 4
	[0080.049] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.049] lstrlenW (lpString=".rar") returned 4
	[0080.049] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.049] lstrlenW (lpString=".bz2") returned 4
	[0080.049] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.050] lstrlenW (lpString=".7z") returned 3
	[0080.050] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.050] lstrlenW (lpString=".dbf") returned 4
	[0080.050] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.051] lstrlenW (lpString=".1cd") returned 4
	[0080.051] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.051] lstrlenW (lpString=".jpg") returned 4
	[0080.051] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.052] lstrlenW (lpString=".doc") returned 4
	[0080.052] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0080.052] lstrlenW (lpString=".docx") returned 5
	[0080.053] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0080.053] lstrlenW (lpString=".pdf") returned 4
	[0080.053] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0080.053] lstrlenW (lpString=".xls") returned 4
	[0080.053] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0080.053] lstrlenW (lpString=".xlsx") returned 5
	[0080.054] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0080.054] lstrlenW (lpString=".ppt") returned 4
	[0080.054] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0080.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.054] lstrlenW (lpString=".zip") returned 4
	[0080.054] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0080.054] lstrlenW (lpString=".rar") returned 4
	[0080.055] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0080.055] lstrlenW (lpString=".bz2") returned 4
	[0080.055] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0080.055] lstrlenW (lpString=".7z") returned 3
	[0080.055] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0080.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.056] lstrlenW (lpString=".dbf") returned 4
	[0080.056] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0080.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.056] lstrlenW (lpString=".1cd") returned 4
	[0080.056] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0080.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0080.057] lstrlenW (lpString=".jpg") returned 4
	[0080.057] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0080.058] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0080.058] lstrlenW (lpString="PubLR.cab") returned 9
	[0080.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0080.059] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9958388) returned 1
	[0080.059] CloseHandle (hObject=0x1dc) returned 1
	[0080.059] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020
	[0080.059] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0080.060] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0080.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0080.061] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0080.062] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.062] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.395] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.395] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.625] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0080.625] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0080.625] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0080.820] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0080.820] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0081.187] SetEndOfFile (hFile=0x1dc) returned 1
	[0081.188] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f67008
	[0081.197] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.197] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f67008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f67008*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.200] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.201] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f67008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f67008*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.211] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0081.211] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f67008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f67008*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0081.469] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f67008 | out: hHeap=0x2e0000) returned 1
	[0081.469] CloseHandle (hObject=0x1dc) returned 1
	[0084.215] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0084.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.216] lstrlenW (lpString=".doc") returned 4
	[0084.216] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0084.216] lstrlenW (lpString=".docx") returned 5
	[0084.216] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0084.216] lstrlenW (lpString=".pdf") returned 4
	[0084.217] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString=".xls") returned 4
	[0084.217] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0084.217] lstrlenW (lpString=".xlsx") returned 5
	[0084.217] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0084.217] lstrlenW (lpString=".ppt") returned 4
	[0084.217] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0084.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.218] lstrlenW (lpString=".zip") returned 4
	[0084.218] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0084.218] lstrlenW (lpString=".rar") returned 4
	[0084.218] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0084.218] lstrlenW (lpString=".bz2") returned 4
	[0084.218] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0084.218] lstrlenW (lpString=".7z") returned 3
	[0084.219] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0084.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.219] lstrlenW (lpString=".dbf") returned 4
	[0084.219] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0084.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.219] lstrlenW (lpString=".1cd") returned 4
	[0084.219] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0084.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.220] lstrlenW (lpString=".jpg") returned 4
	[0084.220] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0084.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.221] lstrlenW (lpString=".doc") returned 4
	[0084.221] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0084.221] lstrlenW (lpString=".docx") returned 5
	[0084.221] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0084.221] lstrlenW (lpString=".pdf") returned 4
	[0084.221] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0084.221] lstrlenW (lpString=".xls") returned 4
	[0084.221] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0084.222] lstrlenW (lpString=".xlsx") returned 5
	[0084.222] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0084.222] lstrlenW (lpString=".ppt") returned 4
	[0084.222] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0084.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.222] lstrlenW (lpString=".zip") returned 4
	[0084.222] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0084.223] lstrlenW (lpString=".rar") returned 4
	[0084.223] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0084.223] lstrlenW (lpString=".bz2") returned 4
	[0084.223] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0084.223] lstrlenW (lpString=".7z") returned 3
	[0084.223] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0084.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.223] lstrlenW (lpString=".dbf") returned 4
	[0084.223] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0084.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.224] lstrlenW (lpString=".1cd") returned 4
	[0084.224] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0084.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0084.224] lstrlenW (lpString=".jpg") returned 4
	[0084.224] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0084.225] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0084.225] lstrlenW (lpString="WordLR.cab") returned 10
	[0084.226] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0084.226] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=43806141) returned 1
	[0084.226] CloseHandle (hObject=0x1dc) returned 1
	[0084.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020
	[0084.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0084.227] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0084.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0084.228] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0084.229] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0084.229] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.725] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.725] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.495] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.495] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.495] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.677] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.677] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0086.704] SetEndOfFile (hFile=0x1dc) returned 1
	[0086.705] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f64ff8
	[0086.776] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.776] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.778] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.778] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.782] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.783] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.787] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f64ff8 | out: hHeap=0x2e0000) returned 1
	[0086.787] CloseHandle (hObject=0x1dc) returned 1
	[0090.505] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0090.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.506] lstrlenW (lpString=".doc") returned 4
	[0090.506] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0090.506] lstrlenW (lpString=".docx") returned 5
	[0090.506] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0090.506] lstrlenW (lpString=".pdf") returned 4
	[0090.507] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0090.507] lstrlenW (lpString=".xls") returned 4
	[0090.507] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0090.507] lstrlenW (lpString=".xlsx") returned 5
	[0090.507] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0090.507] lstrlenW (lpString=".ppt") returned 4
	[0090.507] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0090.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.508] lstrlenW (lpString=".zip") returned 4
	[0090.508] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0090.508] lstrlenW (lpString=".rar") returned 4
	[0090.508] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0090.508] lstrlenW (lpString=".bz2") returned 4
	[0090.508] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0090.509] lstrlenW (lpString=".7z") returned 3
	[0090.509] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0090.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.509] lstrlenW (lpString=".dbf") returned 4
	[0090.509] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0090.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.509] lstrlenW (lpString=".1cd") returned 4
	[0090.510] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0090.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.510] lstrlenW (lpString=".jpg") returned 4
	[0090.510] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0090.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.512] lstrlenW (lpString=".doc") returned 4
	[0090.512] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0090.512] lstrlenW (lpString=".docx") returned 5
	[0090.512] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0090.512] lstrlenW (lpString=".pdf") returned 4
	[0090.512] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0090.513] lstrlenW (lpString=".xls") returned 4
	[0090.513] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0090.513] lstrlenW (lpString=".xlsx") returned 5
	[0090.513] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0090.513] lstrlenW (lpString=".ppt") returned 4
	[0090.513] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0090.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.513] lstrlenW (lpString=".zip") returned 4
	[0090.514] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0090.514] lstrlenW (lpString=".rar") returned 4
	[0090.514] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0090.514] lstrlenW (lpString=".bz2") returned 4
	[0090.514] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0090.514] lstrlenW (lpString=".7z") returned 3
	[0090.514] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0090.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.515] lstrlenW (lpString=".dbf") returned 4
	[0090.515] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0090.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.515] lstrlenW (lpString=".1cd") returned 4
	[0090.515] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0090.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0090.516] lstrlenW (lpString=".jpg") returned 4
	[0090.516] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0090.517] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0090.517] lstrlenW (lpString="Proof.cab") returned 9
	[0090.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0090.518] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=21064532) returned 1
	[0090.518] CloseHandle (hObject=0x1dc) returned 1
	[0090.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020
	[0090.518] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0090.519] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0090.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0090.798] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0090.798] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.798] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0090.903] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.913] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0090.980] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0090.980] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0090.981] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0091.200] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.200] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0091.339] SetEndOfFile (hFile=0x1dc) returned 1
	[0091.339] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f64ff8
	[0091.339] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.339] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.341] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.341] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.342] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0091.343] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0091.345] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f64ff8 | out: hHeap=0x2e0000) returned 1
	[0091.345] CloseHandle (hObject=0x1dc) returned 1
	[0096.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0096.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.649] lstrlenW (lpString=".doc") returned 4
	[0096.649] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0096.649] lstrlenW (lpString=".docx") returned 5
	[0096.649] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0096.650] lstrlenW (lpString=".pdf") returned 4
	[0096.650] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0096.650] lstrlenW (lpString=".xls") returned 4
	[0096.650] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0096.650] lstrlenW (lpString=".xlsx") returned 5
	[0096.650] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0096.650] lstrlenW (lpString=".ppt") returned 4
	[0096.650] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0096.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.650] lstrlenW (lpString=".zip") returned 4
	[0096.650] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0096.650] lstrlenW (lpString=".rar") returned 4
	[0096.650] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0096.651] lstrlenW (lpString=".bz2") returned 4
	[0096.651] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0096.651] lstrlenW (lpString=".7z") returned 3
	[0096.651] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0096.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.651] lstrlenW (lpString=".dbf") returned 4
	[0096.651] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0096.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.651] lstrlenW (lpString=".1cd") returned 4
	[0096.651] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0096.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.651] lstrlenW (lpString=".jpg") returned 4
	[0096.652] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0096.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.652] lstrlenW (lpString=".doc") returned 4
	[0096.652] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0096.653] lstrlenW (lpString=".docx") returned 5
	[0096.653] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0096.653] lstrlenW (lpString=".pdf") returned 4
	[0096.653] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0096.653] lstrlenW (lpString=".xls") returned 4
	[0096.653] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0096.653] lstrlenW (lpString=".xlsx") returned 5
	[0096.653] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0096.654] lstrlenW (lpString=".ppt") returned 4
	[0096.654] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0096.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.654] lstrlenW (lpString=".zip") returned 4
	[0096.654] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0096.654] lstrlenW (lpString=".rar") returned 4
	[0096.654] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0096.654] lstrlenW (lpString=".bz2") returned 4
	[0096.654] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0096.655] lstrlenW (lpString=".7z") returned 3
	[0096.655] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0096.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.655] lstrlenW (lpString=".dbf") returned 4
	[0096.655] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0096.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.655] lstrlenW (lpString=".1cd") returned 4
	[0096.655] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0096.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0096.656] lstrlenW (lpString=".jpg") returned 4
	[0096.656] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0096.657] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0096.657] lstrlenW (lpString="InfoPathMUI.msi") returned 15
	[0096.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0096.657] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3124224) returned 1
	[0096.658] CloseHandle (hObject=0x1dc) returned 1
	[0096.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020
	[0096.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0096.659] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0096.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0096.660] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0096.660] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.660] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.689] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.691] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.713] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.713] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.714] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0097.319] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0097.319] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc010a, lpOverlapped=0x0) returned 1
	[0097.602] SetEndOfFile (hFile=0x1dc) returned 1
	[0097.602] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ef3fe8
	[0097.613] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.613] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.616] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.616] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.625] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0097.625] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x336fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0097.629] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ef3fe8 | out: hHeap=0x2e0000) returned 1
	[0097.629] CloseHandle (hObject=0x1dc) returned 1
	[0099.060] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0099.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.061] lstrlenW (lpString=".doc") returned 4
	[0099.062] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.062] lstrlenW (lpString=".docx") returned 5
	[0099.062] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.062] lstrlenW (lpString=".pdf") returned 4
	[0099.062] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.062] lstrlenW (lpString=".xls") returned 4
	[0099.063] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.063] lstrlenW (lpString=".xlsx") returned 5
	[0099.063] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.063] lstrlenW (lpString=".ppt") returned 4
	[0099.063] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.064] lstrlenW (lpString=".zip") returned 4
	[0099.064] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.064] lstrlenW (lpString=".rar") returned 4
	[0099.064] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.064] lstrlenW (lpString=".bz2") returned 4
	[0099.064] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.065] lstrlenW (lpString=".7z") returned 3
	[0099.065] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.065] lstrlenW (lpString=".dbf") returned 4
	[0099.066] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.066] lstrlenW (lpString=".1cd") returned 4
	[0099.066] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.066] lstrlenW (lpString=".jpg") returned 4
	[0099.067] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.067] lstrlenW (lpString=".doc") returned 4
	[0099.067] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.068] lstrlenW (lpString=".docx") returned 5
	[0099.068] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.068] lstrlenW (lpString=".pdf") returned 4
	[0099.068] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.068] lstrlenW (lpString=".xls") returned 4
	[0099.071] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.071] lstrlenW (lpString=".xlsx") returned 5
	[0099.071] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.071] lstrlenW (lpString=".ppt") returned 4
	[0099.071] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.072] lstrlenW (lpString=".zip") returned 4
	[0099.072] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.072] lstrlenW (lpString=".rar") returned 4
	[0099.072] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.072] lstrlenW (lpString=".bz2") returned 4
	[0099.072] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.072] lstrlenW (lpString=".7z") returned 3
	[0099.073] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.073] lstrlenW (lpString=".dbf") returned 4
	[0099.073] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.073] lstrlenW (lpString=".1cd") returned 4
	[0099.073] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0099.074] lstrlenW (lpString=".jpg") returned 4
	[0099.074] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.075] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0099.075] lstrlenW (lpString="OneNoteMUI.msi") returned 14
	[0099.075] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0099.076] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2503680) returned 1
	[0099.076] CloseHandle (hObject=0x1dc) returned 1
	[0099.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020
	[0099.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.077] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0099.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0099.078] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.079] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.079] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b60058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.176] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.176] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.288] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x336fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.288] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x336fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.289] ReadFile (in: hFile=0x1dc, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x336fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x336fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.325] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.325] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x336fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x336fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0099.790] SetEndOfFile (hFile=0x1dc) returned 1
	[0099.791] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ef3fe8
	[0099.791] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.791] WriteFile (hFile=0x1dc, lpBuffer=0x3ef3fe8, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x336fc88, lpOverlapped=0x0) 

Thread:
	id = 17
	os_tid = 0x31c

	[0072.633] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3654508
	[0072.635] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3664510
	[0072.636] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330c98
	[0072.636] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x331030
	[0072.636] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330cb0
	[0072.636] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3c70020
	[0072.639] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330cc8
	[0072.639] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330cc8, Size=0x20) returned 0x339a88
	[0072.639] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330cc8
	[0072.640] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330cc8, Size=0x20) returned 0x339ab0
	[0072.640] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.641] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.641] Wow64DisableWow64FsRedirection (in: OldValue=0x35bff58 | out: OldValue=0x35bff58*=0x0) returned 1
	[0072.641] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.642] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339a88 | out: hHeap=0x2e0000) returned 1
	[0072.642] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.642] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339ab0 | out: hHeap=0x2e0000) returned 1
	[0072.643] Sleep (dwMilliseconds=0x64) 
	[0073.281] Sleep (dwMilliseconds=0x64) 
	[0073.481] Sleep (dwMilliseconds=0x64) 
	[0074.903] Sleep (dwMilliseconds=0x64) 
	[0075.074] Sleep (dwMilliseconds=0x64) 
	[0075.274] Sleep (dwMilliseconds=0x64) 
	[0075.663] Sleep (dwMilliseconds=0x64) 
	[0075.927] Sleep (dwMilliseconds=0x64) 
	[0076.443] Sleep (dwMilliseconds=0x64) 
	[0076.645] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.646] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.646] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.646] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=90704) returned 1
	[0076.647] CloseHandle (hObject=0x190) returned 1
	[0076.647] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20
	[0076.647] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.647] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.648] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.648] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.648] lstrlenW (lpString=".doc") returned 4
	[0076.648] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.649] lstrlenW (lpString=".docx") returned 5
	[0076.649] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.649] lstrlenW (lpString=".pdf") returned 4
	[0076.649] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.649] lstrlenW (lpString=".xls") returned 4
	[0076.649] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.650] lstrlenW (lpString=".xlsx") returned 5
	[0076.650] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.650] lstrlenW (lpString=".ppt") returned 4
	[0076.650] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.650] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.650] lstrlenW (lpString=".zip") returned 4
	[0076.651] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.651] lstrlenW (lpString=".rar") returned 4
	[0076.651] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.651] lstrlenW (lpString=".bz2") returned 4
	[0076.651] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.651] lstrlenW (lpString=".7z") returned 3
	[0076.652] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.652] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.652] lstrlenW (lpString=".dbf") returned 4
	[0076.652] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.652] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.653] lstrlenW (lpString=".1cd") returned 4
	[0076.653] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.653] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.653] lstrlenW (lpString=".jpg") returned 4
	[0076.653] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.654] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.654] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.654] lstrlenW (lpString=".doc") returned 4
	[0076.654] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.654] lstrlenW (lpString=".docx") returned 5
	[0076.655] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.655] lstrlenW (lpString=".pdf") returned 4
	[0076.655] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.655] lstrlenW (lpString=".xls") returned 4
	[0076.655] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.655] lstrlenW (lpString=".xlsx") returned 5
	[0076.656] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.656] lstrlenW (lpString=".ppt") returned 4
	[0076.656] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.656] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.656] lstrlenW (lpString=".zip") returned 4
	[0076.656] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.657] lstrlenW (lpString=".rar") returned 4
	[0076.657] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.657] lstrlenW (lpString=".bz2") returned 4
	[0076.657] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.657] lstrlenW (lpString=".7z") returned 3
	[0076.657] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.658] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.658] lstrlenW (lpString=".dbf") returned 4
	[0076.658] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.658] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.658] lstrlenW (lpString=".1cd") returned 4
	[0076.658] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.660] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0076.660] lstrlenW (lpString=".jpg") returned 4
	[0076.660] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.661] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.661] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.661] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.662] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=76352) returned 1
	[0076.662] CloseHandle (hObject=0x190) returned 1
	[0076.663] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20
	[0076.663] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.663] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.663] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.664] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.664] lstrlenW (lpString=".doc") returned 4
	[0076.664] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.664] lstrlenW (lpString=".docx") returned 5
	[0076.664] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.664] lstrlenW (lpString=".pdf") returned 4
	[0076.665] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.665] lstrlenW (lpString=".xls") returned 4
	[0076.665] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.665] lstrlenW (lpString=".xlsx") returned 5
	[0076.665] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.666] lstrlenW (lpString=".ppt") returned 4
	[0076.666] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.666] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.666] lstrlenW (lpString=".zip") returned 4
	[0076.666] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.666] lstrlenW (lpString=".rar") returned 4
	[0076.667] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.667] lstrlenW (lpString=".bz2") returned 4
	[0076.667] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.667] lstrlenW (lpString=".7z") returned 3
	[0076.667] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.667] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.668] lstrlenW (lpString=".dbf") returned 4
	[0076.668] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.668] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.668] lstrlenW (lpString=".1cd") returned 4
	[0076.668] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.669] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.669] lstrlenW (lpString=".jpg") returned 4
	[0076.669] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.669] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.669] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.670] lstrlenW (lpString=".doc") returned 4
	[0076.670] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.670] lstrlenW (lpString=".docx") returned 5
	[0076.670] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.670] lstrlenW (lpString=".pdf") returned 4
	[0076.670] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.671] lstrlenW (lpString=".xls") returned 4
	[0076.671] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.671] lstrlenW (lpString=".xlsx") returned 5
	[0076.671] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.671] lstrlenW (lpString=".ppt") returned 4
	[0076.671] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.672] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.672] lstrlenW (lpString=".zip") returned 4
	[0076.672] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.672] lstrlenW (lpString=".rar") returned 4
	[0076.672] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.672] lstrlenW (lpString=".bz2") returned 4
	[0076.673] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.673] lstrlenW (lpString=".7z") returned 3
	[0076.673] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.673] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.673] lstrlenW (lpString=".dbf") returned 4
	[0076.673] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.673] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.674] lstrlenW (lpString=".1cd") returned 4
	[0076.674] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.674] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0076.674] lstrlenW (lpString=".jpg") returned 4
	[0076.675] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.676] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.676] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.676] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.677] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=75344) returned 1
	[0076.677] CloseHandle (hObject=0x190) returned 1
	[0076.677] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20
	[0076.677] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.678] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.678] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.678] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.678] lstrlenW (lpString=".doc") returned 4
	[0076.678] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.679] lstrlenW (lpString=".docx") returned 5
	[0076.679] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.679] lstrlenW (lpString=".pdf") returned 4
	[0076.679] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.679] lstrlenW (lpString=".xls") returned 4
	[0076.680] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.680] lstrlenW (lpString=".xlsx") returned 5
	[0076.680] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.680] lstrlenW (lpString=".ppt") returned 4
	[0076.680] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.680] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.681] lstrlenW (lpString=".zip") returned 4
	[0076.681] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.681] lstrlenW (lpString=".rar") returned 4
	[0076.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.681] lstrlenW (lpString=".bz2") returned 4
	[0076.682] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.682] lstrlenW (lpString=".7z") returned 3
	[0076.682] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.682] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.682] lstrlenW (lpString=".dbf") returned 4
	[0076.683] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.683] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.683] lstrlenW (lpString=".1cd") returned 4
	[0076.683] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.683] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.683] lstrlenW (lpString=".jpg") returned 4
	[0076.684] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.684] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.684] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.684] lstrlenW (lpString=".doc") returned 4
	[0076.684] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.685] lstrlenW (lpString=".docx") returned 5
	[0076.685] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.685] lstrlenW (lpString=".pdf") returned 4
	[0076.685] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.685] lstrlenW (lpString=".xls") returned 4
	[0076.685] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.686] lstrlenW (lpString=".xlsx") returned 5
	[0076.686] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.686] lstrlenW (lpString=".ppt") returned 4
	[0076.686] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.686] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.686] lstrlenW (lpString=".zip") returned 4
	[0076.687] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.687] lstrlenW (lpString=".rar") returned 4
	[0076.687] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.687] lstrlenW (lpString=".bz2") returned 4
	[0076.687] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.687] lstrlenW (lpString=".7z") returned 3
	[0076.688] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.688] lstrlenW (lpString=".dbf") returned 4
	[0076.688] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.689] lstrlenW (lpString=".1cd") returned 4
	[0076.689] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.689] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0076.689] lstrlenW (lpString=".jpg") returned 4
	[0076.689] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.690] lstrcmpiW (lpString1=".exe", lpString2=".lina") returned -1
	[0076.690] lstrlenW (lpString="memtest.exe") returned 11
	[0076.691] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.787] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=485760) returned 1
	[0076.787] CloseHandle (hObject=0x190) returned 1
	[0076.787] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20
	[0076.787] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.788] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.788] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.788] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.788] lstrlenW (lpString=".doc") returned 4
	[0076.788] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0076.789] lstrlenW (lpString=".docx") returned 5
	[0076.789] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0076.789] lstrlenW (lpString=".pdf") returned 4
	[0076.789] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0076.789] lstrlenW (lpString=".xls") returned 4
	[0076.789] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0076.790] lstrlenW (lpString=".xlsx") returned 5
	[0076.790] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0076.790] lstrlenW (lpString=".ppt") returned 4
	[0076.790] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0076.790] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.790] lstrlenW (lpString=".zip") returned 4
	[0076.790] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0076.791] lstrlenW (lpString=".rar") returned 4
	[0076.791] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0076.791] lstrlenW (lpString=".bz2") returned 4
	[0076.791] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0076.791] lstrlenW (lpString=".7z") returned 3
	[0076.791] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0076.792] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.792] lstrlenW (lpString=".dbf") returned 4
	[0076.792] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0076.792] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.792] lstrlenW (lpString=".1cd") returned 4
	[0076.792] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0076.792] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.793] lstrlenW (lpString=".jpg") returned 4
	[0076.793] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0076.793] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.793] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.793] lstrlenW (lpString=".doc") returned 4
	[0076.794] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0076.794] lstrlenW (lpString=".docx") returned 5
	[0076.794] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0076.794] lstrlenW (lpString=".pdf") returned 4
	[0076.794] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0076.794] lstrlenW (lpString=".xls") returned 4
	[0076.795] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0076.795] lstrlenW (lpString=".xlsx") returned 5
	[0076.795] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0076.795] lstrlenW (lpString=".ppt") returned 4
	[0076.795] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0076.795] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.795] lstrlenW (lpString=".zip") returned 4
	[0076.796] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0076.796] lstrlenW (lpString=".rar") returned 4
	[0076.796] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0076.796] lstrlenW (lpString=".bz2") returned 4
	[0076.796] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0076.796] lstrlenW (lpString=".7z") returned 3
	[0076.796] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0076.797] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.797] lstrlenW (lpString=".dbf") returned 4
	[0076.797] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0076.797] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.797] lstrlenW (lpString=".1cd") returned 4
	[0076.797] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0076.797] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0076.798] lstrlenW (lpString=".jpg") returned 4
	[0076.798] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0076.799] Sleep (dwMilliseconds=0x64) 
	[0076.894] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.894] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.894] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.894] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=89664) returned 1
	[0076.895] CloseHandle (hObject=0x194) returned 1
	[0076.895] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20
	[0076.895] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.895] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.896] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.896] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.896] lstrlenW (lpString=".doc") returned 4
	[0076.896] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.896] lstrlenW (lpString=".docx") returned 5
	[0076.897] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.897] lstrlenW (lpString=".pdf") returned 4
	[0076.897] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.897] lstrlenW (lpString=".xls") returned 4
	[0076.897] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.897] lstrlenW (lpString=".xlsx") returned 5
	[0076.898] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.898] lstrlenW (lpString=".ppt") returned 4
	[0076.898] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.898] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.898] lstrlenW (lpString=".zip") returned 4
	[0076.899] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.899] lstrlenW (lpString=".rar") returned 4
	[0076.899] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.899] lstrlenW (lpString=".bz2") returned 4
	[0076.899] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.899] lstrlenW (lpString=".7z") returned 3
	[0076.900] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.900] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.900] lstrlenW (lpString=".dbf") returned 4
	[0076.900] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.900] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.900] lstrlenW (lpString=".1cd") returned 4
	[0076.901] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.901] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.901] lstrlenW (lpString=".jpg") returned 4
	[0076.901] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.902] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.902] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.902] lstrlenW (lpString=".doc") returned 4
	[0076.902] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.902] lstrlenW (lpString=".docx") returned 5
	[0076.902] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.903] lstrlenW (lpString=".pdf") returned 4
	[0076.903] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.903] lstrlenW (lpString=".xls") returned 4
	[0076.903] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.903] lstrlenW (lpString=".xlsx") returned 5
	[0076.904] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.904] lstrlenW (lpString=".ppt") returned 4
	[0076.904] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.904] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.904] lstrlenW (lpString=".zip") returned 4
	[0076.904] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.905] lstrlenW (lpString=".rar") returned 4
	[0076.905] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.905] lstrlenW (lpString=".bz2") returned 4
	[0076.905] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.905] lstrlenW (lpString=".7z") returned 3
	[0076.906] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.906] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.906] lstrlenW (lpString=".dbf") returned 4
	[0076.906] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.906] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.906] lstrlenW (lpString=".1cd") returned 4
	[0076.907] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.907] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0076.907] lstrlenW (lpString=".jpg") returned 4
	[0076.907] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.908] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.908] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.909] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.909] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=90192) returned 1
	[0076.909] CloseHandle (hObject=0x194) returned 1
	[0076.910] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20
	[0076.910] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.910] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.911] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.911] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.911] lstrlenW (lpString=".doc") returned 4
	[0076.911] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.911] lstrlenW (lpString=".docx") returned 5
	[0076.911] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.912] lstrlenW (lpString=".pdf") returned 4
	[0076.912] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.912] lstrlenW (lpString=".xls") returned 4
	[0076.912] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.912] lstrlenW (lpString=".xlsx") returned 5
	[0076.913] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.913] lstrlenW (lpString=".ppt") returned 4
	[0076.913] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.913] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.913] lstrlenW (lpString=".zip") returned 4
	[0076.913] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.914] lstrlenW (lpString=".rar") returned 4
	[0076.914] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.914] lstrlenW (lpString=".bz2") returned 4
	[0076.914] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.914] lstrlenW (lpString=".7z") returned 3
	[0076.914] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.915] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.915] lstrlenW (lpString=".dbf") returned 4
	[0076.915] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.915] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.915] lstrlenW (lpString=".1cd") returned 4
	[0076.915] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.915] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.916] lstrlenW (lpString=".jpg") returned 4
	[0076.916] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.916] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.916] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.916] lstrlenW (lpString=".doc") returned 4
	[0076.917] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.917] lstrlenW (lpString=".docx") returned 5
	[0076.917] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.917] lstrlenW (lpString=".pdf") returned 4
	[0076.917] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.917] lstrlenW (lpString=".xls") returned 4
	[0076.918] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.918] lstrlenW (lpString=".xlsx") returned 5
	[0076.918] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.918] lstrlenW (lpString=".ppt") returned 4
	[0076.918] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.918] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.919] lstrlenW (lpString=".zip") returned 4
	[0076.919] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.919] lstrlenW (lpString=".rar") returned 4
	[0076.919] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.919] lstrlenW (lpString=".bz2") returned 4
	[0076.919] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.920] lstrlenW (lpString=".7z") returned 3
	[0076.920] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.920] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.920] lstrlenW (lpString=".dbf") returned 4
	[0076.920] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.921] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.921] lstrlenW (lpString=".1cd") returned 4
	[0076.921] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.921] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0076.921] lstrlenW (lpString=".jpg") returned 4
	[0076.921] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.923] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.923] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.923] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0076.923] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=87616) returned 1
	[0076.924] CloseHandle (hObject=0x194) returned 1
	[0077.024] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20
	[0077.024] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.024] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.024] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29
	[0077.025] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29
	[0077.025] lstrlenW (lpString=".doc") returned 4
	[0077.025] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.025] lstrlenW (lpString=".docx") returned 5
	[0077.025] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0077.025] lstrlenW (lpString=".pdf") returned 4
	[0077.025] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.025] lstrlenW (lpString=".xls") returned 4
	[0077.026] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.026] lstrlenW (lpString=".xlsx") returned 5
	[0077.026] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0077.026] lstrlenW (lpString=".ppt") returned 4
	[0077.026] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.026] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29
	[0077.026] lstrlenW (lpString=".zip") returned 4
	[0077.026] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.027] lstrlenW (lpString=".rar") returned 4
	[0077.027] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.027] lstrlenW (lpString=".bz2") returned 4
	[0077.027] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.027] lstrlenW (lpString=".7z") returned 3
	[0077.027] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.028] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29
	[0077.028] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.028] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.028] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.029] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.029] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0077.029] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.029] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0077.030] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.030] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.030] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.030] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.031] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.031] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.031] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.031] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.032] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0077.039] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=87104) returned 1
	[0077.039] CloseHandle (hObject=0x194) returned 1
	[0077.039] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20
	[0077.040] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.040] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.040] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.041] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0077.041] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.041] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.041] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0077.041] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.042] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.042] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.042] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.042] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.042] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.043] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.043] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.043] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.043] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0077.044] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.044] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.044] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0077.044] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.044] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.045] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.045] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.045] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.045] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.045] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.045] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.046] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0077.047] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=70720) returned 1
	[0077.047] CloseHandle (hObject=0x194) returned 1
	[0077.047] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20
	[0077.048] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.048] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.048] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.048] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0077.049] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.049] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.049] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0077.049] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.050] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.050] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.050] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.050] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.050] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.051] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.051] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.051] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.052] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0077.052] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.052] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.052] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0077.053] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0077.053] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0077.053] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0077.053] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0077.054] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0077.054] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0077.054] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0077.054] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0077.056] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0077.056] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=70224) returned 1
	[0077.056] CloseHandle (hObject=0x194) returned 1
	[0077.057] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20
	[0077.057] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.057] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.057] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0077.058] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0077.058] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0077.058] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0077.058] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0077.060] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=70208) returned 1
	[0077.060] CloseHandle (hObject=0x194) returned 1
	[0077.061] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20
	[0077.061] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0077.061] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.754] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0077.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0077.759] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0077.759] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.759] ReadFile (in: hFile=0x190, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.772] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.776] ReadFile (in: hFile=0x190, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0077.784] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0077.784] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0077.784] ReadFile (in: hFile=0x190, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.002] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.003] WriteFile (in: hFile=0x190, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0078.025] SetEndOfFile (hFile=0x190) returned 1
	[0078.026] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ec3fd0
	[0078.328] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.329] WriteFile (in: hFile=0x190, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.330] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.330] WriteFile (in: hFile=0x190, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.332] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.332] WriteFile (in: hFile=0x190, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.335] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ec3fd0 | out: hHeap=0x2e0000) returned 1
	[0078.335] CloseHandle (hObject=0x190) returned 1
	[0085.240] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.241] lstrlenW (lpString=".doc") returned 4
	[0085.241] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0085.241] lstrlenW (lpString=".docx") returned 5
	[0085.242] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0085.242] lstrlenW (lpString=".pdf") returned 4
	[0085.242] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0085.242] lstrlenW (lpString=".xls") returned 4
	[0085.242] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0085.242] lstrlenW (lpString=".xlsx") returned 5
	[0085.242] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0085.242] lstrlenW (lpString=".ppt") returned 4
	[0085.243] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0085.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.243] lstrlenW (lpString=".zip") returned 4
	[0085.243] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0085.243] lstrlenW (lpString=".rar") returned 4
	[0085.243] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0085.243] lstrlenW (lpString=".bz2") returned 4
	[0085.243] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0085.243] lstrlenW (lpString=".7z") returned 3
	[0085.244] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0085.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.244] lstrlenW (lpString=".dbf") returned 4
	[0085.244] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0085.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.244] lstrlenW (lpString=".1cd") returned 4
	[0085.244] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0085.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.244] lstrlenW (lpString=".jpg") returned 4
	[0085.245] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0085.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.245] lstrlenW (lpString=".doc") returned 4
	[0085.245] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0085.245] lstrlenW (lpString=".docx") returned 5
	[0085.245] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0085.245] lstrlenW (lpString=".pdf") returned 4
	[0085.246] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0085.246] lstrlenW (lpString=".xls") returned 4
	[0085.246] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0085.246] lstrlenW (lpString=".xlsx") returned 5
	[0085.246] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0085.246] lstrlenW (lpString=".ppt") returned 4
	[0085.246] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0085.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.246] lstrlenW (lpString=".zip") returned 4
	[0085.247] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0085.247] lstrlenW (lpString=".rar") returned 4
	[0085.247] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0085.247] lstrlenW (lpString=".bz2") returned 4
	[0085.247] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0085.247] lstrlenW (lpString=".7z") returned 3
	[0085.247] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0085.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.247] lstrlenW (lpString=".dbf") returned 4
	[0085.248] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0085.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.248] lstrlenW (lpString=".1cd") returned 4
	[0085.248] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0085.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0085.248] lstrlenW (lpString=".jpg") returned 4
	[0085.248] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0085.249] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0085.249] lstrlenW (lpString="WordMUI.msi") returned 11
	[0085.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0085.249] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=2522624) returned 1
	[0085.249] CloseHandle (hObject=0x208) returned 1
	[0085.250] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020
	[0085.250] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.250] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0085.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0085.251] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0085.251] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.251] ReadFile (in: hFile=0x208, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.876] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.876] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0085.934] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0085.935] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0085.935] ReadFile (in: hFile=0x208, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.011] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.012] WriteFile (in: hFile=0x208, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0086.126] SetEndOfFile (hFile=0x208) returned 1
	[0086.126] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f64ff8
	[0086.127] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.127] WriteFile (in: hFile=0x208, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.129] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.129] WriteFile (in: hFile=0x208, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.138] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.139] WriteFile (in: hFile=0x208, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.143] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f64ff8 | out: hHeap=0x2e0000) returned 1
	[0086.144] CloseHandle (hObject=0x208) returned 1
	[0086.902] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0086.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.903] lstrlenW (lpString=".doc") returned 4
	[0086.903] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0086.903] lstrlenW (lpString=".docx") returned 5
	[0086.903] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0086.903] lstrlenW (lpString=".pdf") returned 4
	[0086.904] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0086.904] lstrlenW (lpString=".xls") returned 4
	[0086.904] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0086.904] lstrlenW (lpString=".xlsx") returned 5
	[0086.904] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0086.904] lstrlenW (lpString=".ppt") returned 4
	[0086.904] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0086.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.904] lstrlenW (lpString=".zip") returned 4
	[0086.904] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0086.905] lstrlenW (lpString=".rar") returned 4
	[0086.905] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0086.905] lstrlenW (lpString=".bz2") returned 4
	[0086.905] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0086.905] lstrlenW (lpString=".7z") returned 3
	[0086.905] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0086.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.905] lstrlenW (lpString=".dbf") returned 4
	[0086.905] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0086.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.906] lstrlenW (lpString=".1cd") returned 4
	[0086.906] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0086.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.906] lstrlenW (lpString=".jpg") returned 4
	[0086.906] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0086.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.907] lstrlenW (lpString=".doc") returned 4
	[0086.907] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0086.907] lstrlenW (lpString=".docx") returned 5
	[0086.907] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0086.907] lstrlenW (lpString=".pdf") returned 4
	[0086.907] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0086.907] lstrlenW (lpString=".xls") returned 4
	[0086.907] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0086.908] lstrlenW (lpString=".xlsx") returned 5
	[0086.908] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0086.908] lstrlenW (lpString=".ppt") returned 4
	[0086.908] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0086.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.908] lstrlenW (lpString=".zip") returned 4
	[0086.908] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0086.909] lstrlenW (lpString=".rar") returned 4
	[0086.909] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0086.909] lstrlenW (lpString=".bz2") returned 4
	[0086.909] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0086.909] lstrlenW (lpString=".7z") returned 3
	[0086.909] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0086.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.909] lstrlenW (lpString=".dbf") returned 4
	[0086.909] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0086.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.910] lstrlenW (lpString=".1cd") returned 4
	[0086.910] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0086.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0086.910] lstrlenW (lpString=".jpg") returned 4
	[0086.910] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0086.911] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0086.911] lstrlenW (lpString="Proof.msi") returned 9
	[0086.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0086.912] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=875520) returned 1
	[0086.912] CloseHandle (hObject=0x208) returned 1
	[0086.912] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020
	[0086.912] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0086.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0086.913] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.913] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0086.914] GetLastError () returned 0x0
	[0086.914] ReadFile (in: hFile=0x208, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xd5c00, lpOverlapped=0x0) returned 1
	[0089.764] WriteFile (in: hFile=0x200, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xd5c10, lpOverlapped=0x0) returned 1
	[0089.826] ReadFile (in: hFile=0x208, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0089.826] WriteFile (in: hFile=0x200, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0089.826] SetEndOfFile (hFile=0x200) returned 1
	[0089.827] CloseHandle (hObject=0x200) returned 1
	[0089.838] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0089.838] SetEndOfFile (hFile=0x208) returned 1
	[0089.850] CloseHandle (hObject=0x208) returned 1
	[0089.851] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0089.851] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1
	[0089.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.974] lstrlenW (lpString=".doc") returned 4
	[0089.974] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0089.975] lstrlenW (lpString=".docx") returned 5
	[0089.975] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0089.975] lstrlenW (lpString=".pdf") returned 4
	[0089.975] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0089.975] lstrlenW (lpString=".xls") returned 4
	[0089.975] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0089.975] lstrlenW (lpString=".xlsx") returned 5
	[0089.975] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0089.976] lstrlenW (lpString=".ppt") returned 4
	[0089.976] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0089.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.976] lstrlenW (lpString=".zip") returned 4
	[0089.976] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0089.976] lstrlenW (lpString=".rar") returned 4
	[0089.976] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0089.976] lstrlenW (lpString=".bz2") returned 4
	[0089.977] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0089.977] lstrlenW (lpString=".7z") returned 3
	[0089.977] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0089.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.977] lstrlenW (lpString=".dbf") returned 4
	[0089.977] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0089.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.977] lstrlenW (lpString=".1cd") returned 4
	[0089.978] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0089.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.978] lstrlenW (lpString=".jpg") returned 4
	[0089.978] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0089.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.979] lstrlenW (lpString=".doc") returned 4
	[0089.979] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0089.979] lstrlenW (lpString=".docx") returned 5
	[0089.979] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0089.979] lstrlenW (lpString=".pdf") returned 4
	[0089.979] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0089.979] lstrlenW (lpString=".xls") returned 4
	[0089.980] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0089.980] lstrlenW (lpString=".xlsx") returned 5
	[0089.980] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0089.980] lstrlenW (lpString=".ppt") returned 4
	[0089.980] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0089.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.980] lstrlenW (lpString=".zip") returned 4
	[0089.980] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0089.981] lstrlenW (lpString=".rar") returned 4
	[0089.981] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0089.981] lstrlenW (lpString=".bz2") returned 4
	[0089.981] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0089.982] lstrlenW (lpString=".7z") returned 3
	[0089.982] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0089.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.982] lstrlenW (lpString=".dbf") returned 4
	[0089.982] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0089.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.982] lstrlenW (lpString=".1cd") returned 4
	[0089.983] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0089.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0089.983] lstrlenW (lpString=".jpg") returned 4
	[0089.983] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0089.984] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0089.984] lstrlenW (lpString="Proof.msi") returned 9
	[0089.984] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0091.376] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=881152) returned 1
	[0091.376] CloseHandle (hObject=0x1e0) returned 1
	[0091.376] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020
	[0091.377] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0091.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0091.377] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.377] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0091.378] GetLastError () returned 0x0
	[0091.378] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xd7200, lpOverlapped=0x0) returned 1
	[0091.890] WriteFile (in: hFile=0x200, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xd7210, lpOverlapped=0x0) returned 1
	[0091.922] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0091.922] WriteFile (in: hFile=0x200, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0091.923] SetEndOfFile (hFile=0x200) returned 1
	[0091.923] CloseHandle (hObject=0x200) returned 1
	[0092.266] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.266] SetEndOfFile (hFile=0x1e0) returned 1
	[0092.278] CloseHandle (hObject=0x1e0) returned 1
	[0092.279] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0092.279] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1
	[0092.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.280] lstrlenW (lpString=".doc") returned 4
	[0092.280] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0092.280] lstrlenW (lpString=".docx") returned 5
	[0092.280] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0092.280] lstrlenW (lpString=".pdf") returned 4
	[0092.281] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0092.281] lstrlenW (lpString=".xls") returned 4
	[0092.281] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0092.281] lstrlenW (lpString=".xlsx") returned 5
	[0092.281] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0092.281] lstrlenW (lpString=".ppt") returned 4
	[0092.281] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0092.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.281] lstrlenW (lpString=".zip") returned 4
	[0092.281] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0092.282] lstrlenW (lpString=".rar") returned 4
	[0092.282] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0092.282] lstrlenW (lpString=".bz2") returned 4
	[0092.282] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0092.282] lstrlenW (lpString=".7z") returned 3
	[0092.282] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0092.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.282] lstrlenW (lpString=".dbf") returned 4
	[0092.282] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0092.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.283] lstrlenW (lpString=".1cd") returned 4
	[0092.283] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0092.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.283] lstrlenW (lpString=".jpg") returned 4
	[0092.283] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0092.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.284] lstrlenW (lpString=".doc") returned 4
	[0092.284] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0092.284] lstrlenW (lpString=".docx") returned 5
	[0092.284] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0092.284] lstrlenW (lpString=".pdf") returned 4
	[0092.284] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0092.284] lstrlenW (lpString=".xls") returned 4
	[0092.285] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0092.285] lstrlenW (lpString=".xlsx") returned 5
	[0092.285] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0092.285] lstrlenW (lpString=".ppt") returned 4
	[0092.285] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0092.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.285] lstrlenW (lpString=".zip") returned 4
	[0092.285] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0092.286] lstrlenW (lpString=".rar") returned 4
	[0092.286] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0092.286] lstrlenW (lpString=".bz2") returned 4
	[0092.286] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0092.286] lstrlenW (lpString=".7z") returned 3
	[0092.286] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0092.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.286] lstrlenW (lpString=".dbf") returned 4
	[0092.287] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0092.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.287] lstrlenW (lpString=".1cd") returned 4
	[0092.287] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0092.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0092.287] lstrlenW (lpString=".jpg") returned 4
	[0092.287] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0092.288] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0092.288] lstrlenW (lpString="Proofing.msi") returned 12
	[0092.289] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0092.289] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=868864) returned 1
	[0092.289] CloseHandle (hObject=0x1e0) returned 1
	[0092.289] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020
	[0092.290] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0092.290] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0092.291] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.291] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0092.292] GetLastError () returned 0x0
	[0092.292] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0094.426] WriteFile (in: hFile=0x200, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0095.172] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x35bfed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.172] WriteFile (in: hFile=0x200, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0095.173] SetEndOfFile (hFile=0x200) returned 1
	[0095.173] CloseHandle (hObject=0x200) returned 1
	[0095.254] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.254] SetEndOfFile (hFile=0x1e0) returned 1
	[0095.267] CloseHandle (hObject=0x1e0) returned 1
	[0095.268] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0095.609] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1
	[0095.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.611] lstrlenW (lpString=".doc") returned 4
	[0095.611] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0095.611] lstrlenW (lpString=".docx") returned 5
	[0095.612] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0095.612] lstrlenW (lpString=".pdf") returned 4
	[0095.612] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0095.612] lstrlenW (lpString=".xls") returned 4
	[0095.612] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0095.614] lstrlenW (lpString=".xlsx") returned 5
	[0095.614] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0095.614] lstrlenW (lpString=".ppt") returned 4
	[0095.615] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0095.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.615] lstrlenW (lpString=".zip") returned 4
	[0095.615] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0095.615] lstrlenW (lpString=".rar") returned 4
	[0095.616] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0095.616] lstrlenW (lpString=".bz2") returned 4
	[0095.616] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0095.616] lstrlenW (lpString=".7z") returned 3
	[0095.616] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0095.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.617] lstrlenW (lpString=".dbf") returned 4
	[0095.617] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0095.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.617] lstrlenW (lpString=".1cd") returned 4
	[0095.618] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0095.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.618] lstrlenW (lpString=".jpg") returned 4
	[0095.618] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0095.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.619] lstrlenW (lpString=".doc") returned 4
	[0095.619] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0095.619] lstrlenW (lpString=".docx") returned 5
	[0095.619] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0095.620] lstrlenW (lpString=".pdf") returned 4
	[0095.620] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0095.620] lstrlenW (lpString=".xls") returned 4
	[0095.620] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0095.620] lstrlenW (lpString=".xlsx") returned 5
	[0095.620] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0095.620] lstrlenW (lpString=".ppt") returned 4
	[0095.621] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0095.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.621] lstrlenW (lpString=".zip") returned 4
	[0095.621] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0095.621] lstrlenW (lpString=".rar") returned 4
	[0095.621] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0095.621] lstrlenW (lpString=".bz2") returned 4
	[0095.622] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0095.622] lstrlenW (lpString=".7z") returned 3
	[0095.622] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0095.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.622] lstrlenW (lpString=".dbf") returned 4
	[0095.622] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0095.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.623] lstrlenW (lpString=".1cd") returned 4
	[0095.623] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0095.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0095.623] lstrlenW (lpString=".jpg") returned 4
	[0095.623] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0095.624] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0095.624] lstrlenW (lpString="OWOW32LR.cab") returned 12
	[0095.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0095.625] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=2928955) returned 1
	[0095.625] CloseHandle (hObject=0x1cc) returned 1
	[0095.626] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020
	[0095.626] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0095.626] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0095.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0095.628] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0095.628] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0095.628] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0095.904] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0095.913] ReadFile (in: hFile=0x1cc, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.042] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.042] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.042] ReadFile (in: hFile=0x1cc, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.290] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.291] WriteFile (in: hFile=0x1cc, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0096.729] SetEndOfFile (hFile=0x1cc) returned 1
	[0096.730] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ef3fe8
	[0096.889] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.889] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.908] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.909] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.918] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.919] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.922] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ef3fe8 | out: hHeap=0x2e0000) returned 1
	[0096.923] CloseHandle (hObject=0x1cc) returned 1
	[0097.722] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0097.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.723] lstrlenW (lpString=".doc") returned 4
	[0097.724] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0097.724] lstrlenW (lpString=".docx") returned 5
	[0097.724] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0097.724] lstrlenW (lpString=".pdf") returned 4
	[0097.724] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0097.724] lstrlenW (lpString=".xls") returned 4
	[0097.725] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0097.725] lstrlenW (lpString=".xlsx") returned 5
	[0097.725] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0097.725] lstrlenW (lpString=".ppt") returned 4
	[0097.725] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0097.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.725] lstrlenW (lpString=".zip") returned 4
	[0097.726] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0097.726] lstrlenW (lpString=".rar") returned 4
	[0097.726] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0097.726] lstrlenW (lpString=".bz2") returned 4
	[0097.726] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0097.726] lstrlenW (lpString=".7z") returned 3
	[0097.726] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0097.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.727] lstrlenW (lpString=".dbf") returned 4
	[0097.727] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0097.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.727] lstrlenW (lpString=".1cd") returned 4
	[0097.727] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0097.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.727] lstrlenW (lpString=".jpg") returned 4
	[0097.727] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0097.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.728] lstrlenW (lpString=".doc") returned 4
	[0097.728] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0097.728] lstrlenW (lpString=".docx") returned 5
	[0097.729] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0097.729] lstrlenW (lpString=".pdf") returned 4
	[0097.729] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0097.729] lstrlenW (lpString=".xls") returned 4
	[0097.729] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0097.729] lstrlenW (lpString=".xlsx") returned 5
	[0097.729] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0097.729] lstrlenW (lpString=".ppt") returned 4
	[0097.730] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0097.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.730] lstrlenW (lpString=".zip") returned 4
	[0097.730] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0097.730] lstrlenW (lpString=".rar") returned 4
	[0097.730] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0097.730] lstrlenW (lpString=".bz2") returned 4
	[0097.731] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0097.731] lstrlenW (lpString=".7z") returned 3
	[0097.731] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0097.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.731] lstrlenW (lpString=".dbf") returned 4
	[0097.731] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0097.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.731] lstrlenW (lpString=".1cd") returned 4
	[0097.732] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0097.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0097.732] lstrlenW (lpString=".jpg") returned 4
	[0097.732] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0097.733] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0097.733] lstrlenW (lpString="VisioLR.cab") returned 11
	[0097.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0097.734] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=50823389) returned 1
	[0097.734] CloseHandle (hObject=0x1cc) returned 1
	[0097.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020
	[0097.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0097.851] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0097.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc
	[0097.853] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0097.854] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0097.854] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.253] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.254] ReadFile (in: hFile=0x1cc, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.370] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0098.371] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.371] ReadFile (in: hFile=0x1cc, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0098.393] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfec8 | out: lpNewFilePointer=0x0) returned 1
	[0098.394] WriteFile (in: hFile=0x1cc, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x35bfcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0098.953] SetEndOfFile (hFile=0x1cc) returned 1
	[0098.954] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ef3fe8
	[0098.954] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.954] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.956] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.956] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.958] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc7c | out: lpNewFilePointer=0x0) returned 1
	[0098.958] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x35bfc88*=0x40000, lpOverlapped=0x0) returned 1
	[0098.962] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ef3fe8 | out: hHeap=0x2e0000) returned 1
	[0099.034] CloseHandle (hObject=0x1cc) returned 1
	[0099.035] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0099.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.036] lstrlenW (lpString=".doc") returned 4
	[0099.036] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.036] lstrlenW (lpString=".docx") returned 5
	[0099.036] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.037] lstrlenW (lpString=".pdf") returned 4
	[0099.037] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.037] lstrlenW (lpString=".xls") returned 4
	[0099.037] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.037] lstrlenW (lpString=".xlsx") returned 5
	[0099.037] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.037] lstrlenW (lpString=".ppt") returned 4
	[0099.038] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.038] lstrlenW (lpString=".zip") returned 4
	[0099.038] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.038] lstrlenW (lpString=".rar") returned 4
	[0099.038] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.039] lstrlenW (lpString=".bz2") returned 4
	[0099.039] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.039] lstrlenW (lpString=".7z") returned 3
	[0099.039] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.039] lstrlenW (lpString=".dbf") returned 4
	[0099.039] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.040] lstrlenW (lpString=".1cd") returned 4
	[0099.040] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.040] lstrlenW (lpString=".jpg") returned 4
	[0099.040] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.208] lstrlenW (lpString=".doc") returned 4
	[0099.208] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0099.208] lstrlenW (lpString=".docx") returned 5
	[0099.208] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0099.209] lstrlenW (lpString=".pdf") returned 4
	[0099.209] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0099.209] lstrlenW (lpString=".xls") returned 4
	[0099.209] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0099.209] lstrlenW (lpString=".xlsx") returned 5
	[0099.209] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0099.210] lstrlenW (lpString=".ppt") returned 4
	[0099.210] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0099.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.210] lstrlenW (lpString=".zip") returned 4
	[0099.210] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0099.210] lstrlenW (lpString=".rar") returned 4
	[0099.210] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0099.211] lstrlenW (lpString=".bz2") returned 4
	[0099.214] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0099.214] lstrlenW (lpString=".7z") returned 3
	[0099.214] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0099.214] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.214] lstrlenW (lpString=".dbf") returned 4
	[0099.215] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0099.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.215] lstrlenW (lpString=".1cd") returned 4
	[0099.215] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0099.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0099.215] lstrlenW (lpString=".jpg") returned 4
	[0099.216] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0099.221] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0099.221] lstrlenW (lpString="ProjectMUI.msi") returned 14
	[0099.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0099.439] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x35bff1c | out: lpFileSize=0x35bff1c*=2511872) returned 1
	[0099.439] CloseHandle (hObject=0x1d8) returned 1
	[0099.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020
	[0099.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0099.440] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0099.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8
	[0099.441] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0x0) returned 1
	[0099.441] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.442] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.457] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.457] ReadFile (in: hFile=0x1d8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x35bfc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.509] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35bfc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.509] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x35bfc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.509] ReadFile (hFile=0x1d8, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bfc38, lpOverlapped=0x0) 

Thread:
	id = 18
	os_tid = 0x114

	[0072.644] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3674518
	[0072.645] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3684520
	[0072.646] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330cc8
	[0072.646] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x331040
	[0072.646] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330ce0
	[0072.646] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3d80020
	[0072.648] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330cf8
	[0072.648] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330cf8, Size=0x20) returned 0x339ab0
	[0072.648] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330cf8
	[0072.649] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330cf8, Size=0x20) returned 0x339a88
	[0072.650] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000
	[0072.651] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650
	[0072.651] Wow64DisableWow64FsRedirection (in: OldValue=0x390ff58 | out: OldValue=0x390ff58*=0x0) returned 1
	[0072.651] lstrlenW (lpString="kernel32.dll") returned 12
	[0072.651] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339ab0 | out: hHeap=0x2e0000) returned 1
	[0072.652] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0072.652] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x339a88 | out: hHeap=0x2e0000) returned 1
	[0072.652] Sleep (dwMilliseconds=0x64) 
	[0073.286] Sleep (dwMilliseconds=0x64) 
	[0073.482] Sleep (dwMilliseconds=0x64) 
	[0074.904] Sleep (dwMilliseconds=0x64) 
	[0075.075] Sleep (dwMilliseconds=0x64) 
	[0075.275] Sleep (dwMilliseconds=0x64) 
	[0075.664] Sleep (dwMilliseconds=0x64) 
	[0075.928] Sleep (dwMilliseconds=0x64) 
	[0076.444] Sleep (dwMilliseconds=0x64) 
	[0076.692] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.692] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.692] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.693] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=88144) returned 1
	[0076.693] CloseHandle (hObject=0x190) returned 1
	[0076.694] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20
	[0076.694] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.694] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.694] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.695] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.695] lstrlenW (lpString=".doc") returned 4
	[0076.695] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.695] lstrlenW (lpString=".docx") returned 5
	[0076.695] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.696] lstrlenW (lpString=".pdf") returned 4
	[0076.696] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.696] lstrlenW (lpString=".xls") returned 4
	[0076.696] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.696] lstrlenW (lpString=".xlsx") returned 5
	[0076.697] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.697] lstrlenW (lpString=".ppt") returned 4
	[0076.697] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.697] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.697] lstrlenW (lpString=".zip") returned 4
	[0076.698] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.698] lstrlenW (lpString=".rar") returned 4
	[0076.698] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.698] lstrlenW (lpString=".bz2") returned 4
	[0076.698] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.699] lstrlenW (lpString=".7z") returned 3
	[0076.699] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.699] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.699] lstrlenW (lpString=".dbf") returned 4
	[0076.699] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.700] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.700] lstrlenW (lpString=".1cd") returned 4
	[0076.700] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.700] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.700] lstrlenW (lpString=".jpg") returned 4
	[0076.700] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.701] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.701] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.701] lstrlenW (lpString=".doc") returned 4
	[0076.701] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.702] lstrlenW (lpString=".docx") returned 5
	[0076.702] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.702] lstrlenW (lpString=".pdf") returned 4
	[0076.702] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.702] lstrlenW (lpString=".xls") returned 4
	[0076.702] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.703] lstrlenW (lpString=".xlsx") returned 5
	[0076.703] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.703] lstrlenW (lpString=".ppt") returned 4
	[0076.703] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.703] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.703] lstrlenW (lpString=".zip") returned 4
	[0076.704] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.704] lstrlenW (lpString=".rar") returned 4
	[0076.704] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.704] lstrlenW (lpString=".bz2") returned 4
	[0076.704] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.704] lstrlenW (lpString=".7z") returned 3
	[0076.705] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.705] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.705] lstrlenW (lpString=".dbf") returned 4
	[0076.705] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.705] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.706] lstrlenW (lpString=".1cd") returned 4
	[0076.706] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.706] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0076.707] lstrlenW (lpString=".jpg") returned 4
	[0076.707] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.708] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.708] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.708] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.709] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=90704) returned 1
	[0076.709] CloseHandle (hObject=0x190) returned 1
	[0076.710] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20
	[0076.710] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.710] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.710] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.711] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.711] lstrlenW (lpString=".doc") returned 4
	[0076.711] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.711] lstrlenW (lpString=".docx") returned 5
	[0076.711] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.711] lstrlenW (lpString=".pdf") returned 4
	[0076.712] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.712] lstrlenW (lpString=".xls") returned 4
	[0076.712] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.712] lstrlenW (lpString=".xlsx") returned 5
	[0076.712] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.712] lstrlenW (lpString=".ppt") returned 4
	[0076.713] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.713] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.713] lstrlenW (lpString=".zip") returned 4
	[0076.713] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.713] lstrlenW (lpString=".rar") returned 4
	[0076.713] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.714] lstrlenW (lpString=".bz2") returned 4
	[0076.714] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.714] lstrlenW (lpString=".7z") returned 3
	[0076.714] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.714] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.714] lstrlenW (lpString=".dbf") returned 4
	[0076.715] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.715] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.715] lstrlenW (lpString=".1cd") returned 4
	[0076.715] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.715] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.716] lstrlenW (lpString=".jpg") returned 4
	[0076.716] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.716] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.716] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.717] lstrlenW (lpString=".doc") returned 4
	[0076.717] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.717] lstrlenW (lpString=".docx") returned 5
	[0076.717] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.717] lstrlenW (lpString=".pdf") returned 4
	[0076.717] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.718] lstrlenW (lpString=".xls") returned 4
	[0076.718] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.718] lstrlenW (lpString=".xlsx") returned 5
	[0076.718] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.718] lstrlenW (lpString=".ppt") returned 4
	[0076.718] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.719] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.719] lstrlenW (lpString=".zip") returned 4
	[0076.719] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.719] lstrlenW (lpString=".rar") returned 4
	[0076.719] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.719] lstrlenW (lpString=".bz2") returned 4
	[0076.720] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.720] lstrlenW (lpString=".7z") returned 3
	[0076.720] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.720] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.720] lstrlenW (lpString=".dbf") returned 4
	[0076.720] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.721] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.721] lstrlenW (lpString=".1cd") returned 4
	[0076.721] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.722] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0076.722] lstrlenW (lpString=".jpg") returned 4
	[0076.723] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.724] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.724] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.724] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.725] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=90704) returned 1
	[0076.725] CloseHandle (hObject=0x190) returned 1
	[0076.725] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20
	[0076.725] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.725] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.726] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.726] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.726] lstrlenW (lpString=".doc") returned 4
	[0076.726] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.726] lstrlenW (lpString=".docx") returned 5
	[0076.726] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.727] lstrlenW (lpString=".pdf") returned 4
	[0076.727] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.727] lstrlenW (lpString=".xls") returned 4
	[0076.727] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.727] lstrlenW (lpString=".xlsx") returned 5
	[0076.727] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.727] lstrlenW (lpString=".ppt") returned 4
	[0076.728] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.728] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.728] lstrlenW (lpString=".zip") returned 4
	[0076.728] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.728] lstrlenW (lpString=".rar") returned 4
	[0076.728] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.728] lstrlenW (lpString=".bz2") returned 4
	[0076.729] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.729] lstrlenW (lpString=".7z") returned 3
	[0076.729] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.729] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.729] lstrlenW (lpString=".dbf") returned 4
	[0076.729] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.729] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.729] lstrlenW (lpString=".1cd") returned 4
	[0076.730] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.730] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.730] lstrlenW (lpString=".jpg") returned 4
	[0076.730] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.730] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.730] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.731] lstrlenW (lpString=".doc") returned 4
	[0076.731] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.731] lstrlenW (lpString=".docx") returned 5
	[0076.731] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.731] lstrlenW (lpString=".pdf") returned 4
	[0076.731] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.731] lstrlenW (lpString=".xls") returned 4
	[0076.731] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.732] lstrlenW (lpString=".xlsx") returned 5
	[0076.732] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.732] lstrlenW (lpString=".ppt") returned 4
	[0076.732] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.732] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.732] lstrlenW (lpString=".zip") returned 4
	[0076.732] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.732] lstrlenW (lpString=".rar") returned 4
	[0076.733] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.733] lstrlenW (lpString=".bz2") returned 4
	[0076.733] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.733] lstrlenW (lpString=".7z") returned 3
	[0076.733] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.733] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.733] lstrlenW (lpString=".dbf") returned 4
	[0076.733] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.734] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.734] lstrlenW (lpString=".1cd") returned 4
	[0076.734] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.734] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0076.734] lstrlenW (lpString=".jpg") returned 4
	[0076.734] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.735] lstrcmpiW (lpString1=".mui", lpString2=".lina") returned 1
	[0076.735] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.735] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0076.736] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=90176) returned 1
	[0076.736] CloseHandle (hObject=0x190) returned 1
	[0076.736] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20
	[0076.737] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0076.840] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0076.840] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.840] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.840] lstrlenW (lpString=".doc") returned 4
	[0076.841] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.841] lstrlenW (lpString=".docx") returned 5
	[0076.841] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.841] lstrlenW (lpString=".pdf") returned 4
	[0076.841] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.841] lstrlenW (lpString=".xls") returned 4
	[0076.841] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.842] lstrlenW (lpString=".xlsx") returned 5
	[0076.842] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.842] lstrlenW (lpString=".ppt") returned 4
	[0076.842] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.842] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.842] lstrlenW (lpString=".zip") returned 4
	[0076.843] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.843] lstrlenW (lpString=".rar") returned 4
	[0076.843] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.843] lstrlenW (lpString=".bz2") returned 4
	[0076.843] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.843] lstrlenW (lpString=".7z") returned 3
	[0076.843] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.844] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.844] lstrlenW (lpString=".dbf") returned 4
	[0076.844] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.844] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.844] lstrlenW (lpString=".1cd") returned 4
	[0076.844] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.845] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.845] lstrlenW (lpString=".jpg") returned 4
	[0076.845] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.845] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.845] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.846] lstrlenW (lpString=".doc") returned 4
	[0076.846] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.846] lstrlenW (lpString=".docx") returned 5
	[0076.847] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.847] lstrlenW (lpString=".pdf") returned 4
	[0076.847] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.847] lstrlenW (lpString=".xls") returned 4
	[0076.847] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0076.847] lstrlenW (lpString=".xlsx") returned 5
	[0076.848] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0076.848] lstrlenW (lpString=".ppt") returned 4
	[0076.848] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.848] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.848] lstrlenW (lpString=".zip") returned 4
	[0076.848] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0076.849] lstrlenW (lpString=".rar") returned 4
	[0076.849] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.849] lstrlenW (lpString=".bz2") returned 4
	[0076.849] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.849] lstrlenW (lpString=".7z") returned 3
	[0076.849] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.850] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.850] lstrlenW (lpString=".dbf") returned 4
	[0076.850] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.850] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.850] lstrlenW (lpString=".1cd") returned 4
	[0076.850] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.851] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0076.851] lstrlenW (lpString=".jpg") returned 4
	[0076.851] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.852] Sleep (dwMilliseconds=0x64) 
	[0077.120] Sleep (dwMilliseconds=0x64) 
	[0077.587] Sleep (dwMilliseconds=0x64) 
	[0077.907] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0077.917] lstrlenW (lpString="PptLR.cab") returned 9
	[0077.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0078.095] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=70361744) returned 1
	[0078.095] CloseHandle (hObject=0x1bc) returned 1
	[0078.096] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020
	[0078.096] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0078.096] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0078.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0078.098] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0078.098] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.098] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.107] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.108] ReadFile (in: hFile=0x1bc, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.118] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0078.119] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0078.119] ReadFile (in: hFile=0x1bc, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0078.350] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0078.350] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0078.430] SetEndOfFile (hFile=0x1bc) returned 1
	[0078.431] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ec3fd0
	[0078.431] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.431] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.433] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.433] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.434] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0078.435] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ec3fd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3fd0*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0078.964] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ec3fd0 | out: hHeap=0x2e0000) returned 1
	[0078.969] CloseHandle (hObject=0x1bc) returned 1
	[0082.457] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0082.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.458] lstrlenW (lpString=".doc") returned 4
	[0082.458] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0082.458] lstrlenW (lpString=".docx") returned 5
	[0082.459] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0082.459] lstrlenW (lpString=".pdf") returned 4
	[0082.459] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0082.459] lstrlenW (lpString=".xls") returned 4
	[0082.459] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0082.459] lstrlenW (lpString=".xlsx") returned 5
	[0082.459] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0082.460] lstrlenW (lpString=".ppt") returned 4
	[0082.460] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0082.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.460] lstrlenW (lpString=".zip") returned 4
	[0082.460] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0082.460] lstrlenW (lpString=".rar") returned 4
	[0082.460] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0082.461] lstrlenW (lpString=".bz2") returned 4
	[0082.461] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0082.461] lstrlenW (lpString=".7z") returned 3
	[0082.461] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0082.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.461] lstrlenW (lpString=".dbf") returned 4
	[0082.461] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0082.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.462] lstrlenW (lpString=".1cd") returned 4
	[0082.462] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0082.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.462] lstrlenW (lpString=".jpg") returned 4
	[0082.462] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0082.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.463] lstrlenW (lpString=".doc") returned 4
	[0082.463] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0082.464] lstrlenW (lpString=".docx") returned 5
	[0082.464] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0082.464] lstrlenW (lpString=".pdf") returned 4
	[0082.464] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0082.464] lstrlenW (lpString=".xls") returned 4
	[0082.464] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0082.465] lstrlenW (lpString=".xlsx") returned 5
	[0082.465] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0082.465] lstrlenW (lpString=".ppt") returned 4
	[0082.465] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0082.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.465] lstrlenW (lpString=".zip") returned 4
	[0082.465] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0082.466] lstrlenW (lpString=".rar") returned 4
	[0082.466] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0082.466] lstrlenW (lpString=".bz2") returned 4
	[0082.466] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0082.466] lstrlenW (lpString=".7z") returned 3
	[0082.466] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0082.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.467] lstrlenW (lpString=".dbf") returned 4
	[0082.467] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0082.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.467] lstrlenW (lpString=".1cd") returned 4
	[0082.467] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0082.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0082.468] lstrlenW (lpString=".jpg") returned 4
	[0082.468] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0082.469] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0082.469] lstrlenW (lpString="OutlookMUI.msi") returned 14
	[0082.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0082.470] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=2865664) returned 1
	[0082.470] CloseHandle (hObject=0x1bc) returned 1
	[0082.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020
	[0082.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0082.470] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0082.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0082.472] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0082.472] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0082.472] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.551] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.551] ReadFile (in: hFile=0x1bc, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.615] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0083.615] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0083.616] ReadFile (in: hFile=0x1bc, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0083.657] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0083.657] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0083.790] SetEndOfFile (hFile=0x1bc) returned 1
	[0083.790] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f64ff8
	[0083.797] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.797] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.799] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.799] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.875] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0083.875] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0083.878] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f64ff8 | out: hHeap=0x2e0000) returned 1
	[0083.878] CloseHandle (hObject=0x1bc) returned 1
	[0085.669] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0085.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.670] lstrlenW (lpString=".doc") returned 4
	[0085.670] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0085.670] lstrlenW (lpString=".docx") returned 5
	[0085.670] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0085.670] lstrlenW (lpString=".pdf") returned 4
	[0085.670] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0085.671] lstrlenW (lpString=".xls") returned 4
	[0085.671] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0085.671] lstrlenW (lpString=".xlsx") returned 5
	[0085.671] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0085.671] lstrlenW (lpString=".ppt") returned 4
	[0085.671] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0085.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.671] lstrlenW (lpString=".zip") returned 4
	[0085.672] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0085.672] lstrlenW (lpString=".rar") returned 4
	[0085.672] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0085.672] lstrlenW (lpString=".bz2") returned 4
	[0085.672] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0085.672] lstrlenW (lpString=".7z") returned 3
	[0085.672] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0085.672] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.673] lstrlenW (lpString=".dbf") returned 4
	[0085.673] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0085.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.673] lstrlenW (lpString=".1cd") returned 4
	[0085.673] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0085.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.673] lstrlenW (lpString=".jpg") returned 4
	[0085.673] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0085.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.674] lstrlenW (lpString=".doc") returned 4
	[0085.674] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0085.674] lstrlenW (lpString=".docx") returned 5
	[0085.674] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0085.674] lstrlenW (lpString=".pdf") returned 4
	[0085.674] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0085.675] lstrlenW (lpString=".xls") returned 4
	[0085.675] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0085.675] lstrlenW (lpString=".xlsx") returned 5
	[0085.675] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0085.675] lstrlenW (lpString=".ppt") returned 4
	[0085.675] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0085.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.676] lstrlenW (lpString=".zip") returned 4
	[0085.676] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0085.676] lstrlenW (lpString=".rar") returned 4
	[0085.676] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0085.676] lstrlenW (lpString=".bz2") returned 4
	[0085.676] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0085.676] lstrlenW (lpString=".7z") returned 3
	[0085.677] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0085.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.677] lstrlenW (lpString=".dbf") returned 4
	[0085.677] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0085.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.677] lstrlenW (lpString=".1cd") returned 4
	[0085.677] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0085.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0085.678] lstrlenW (lpString=".jpg") returned 4
	[0085.678] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0085.679] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0085.679] lstrlenW (lpString="Proof.cab") returned 9
	[0085.679] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0085.679] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=11482605) returned 1
	[0085.680] CloseHandle (hObject=0x1bc) returned 1
	[0085.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020
	[0085.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0085.680] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0086.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0086.164] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0086.207] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.207] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.381] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.381] ReadFile (in: hFile=0x1bc, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.405] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.405] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0086.406] ReadFile (in: hFile=0x1bc, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0086.432] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0086.432] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0086.725] SetEndOfFile (hFile=0x1bc) returned 1
	[0086.725] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f64ff8
	[0086.800] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.801] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.802] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.802] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.818] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0086.818] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f64ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f64ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0086.821] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f64ff8 | out: hHeap=0x2e0000) returned 1
	[0086.822] CloseHandle (hObject=0x1bc) returned 1
	[0091.746] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0091.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.747] lstrlenW (lpString=".doc") returned 4
	[0091.747] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0091.747] lstrlenW (lpString=".docx") returned 5
	[0091.747] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0091.747] lstrlenW (lpString=".pdf") returned 4
	[0091.747] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0091.747] lstrlenW (lpString=".xls") returned 4
	[0091.747] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0091.748] lstrlenW (lpString=".xlsx") returned 5
	[0091.748] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0091.748] lstrlenW (lpString=".ppt") returned 4
	[0091.748] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0091.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.749] lstrlenW (lpString=".zip") returned 4
	[0091.749] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0091.749] lstrlenW (lpString=".rar") returned 4
	[0091.749] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0091.749] lstrlenW (lpString=".bz2") returned 4
	[0091.749] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0091.749] lstrlenW (lpString=".7z") returned 3
	[0091.750] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0091.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.750] lstrlenW (lpString=".dbf") returned 4
	[0091.750] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0091.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.750] lstrlenW (lpString=".1cd") returned 4
	[0091.750] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0091.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.750] lstrlenW (lpString=".jpg") returned 4
	[0091.751] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0091.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.751] lstrlenW (lpString=".doc") returned 4
	[0091.751] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0091.751] lstrlenW (lpString=".docx") returned 5
	[0091.751] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0091.752] lstrlenW (lpString=".pdf") returned 4
	[0091.752] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0091.752] lstrlenW (lpString=".xls") returned 4
	[0091.752] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0091.752] lstrlenW (lpString=".xlsx") returned 5
	[0091.752] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0091.752] lstrlenW (lpString=".ppt") returned 4
	[0091.752] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0091.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.753] lstrlenW (lpString=".zip") returned 4
	[0091.753] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0091.753] lstrlenW (lpString=".rar") returned 4
	[0091.753] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0091.753] lstrlenW (lpString=".bz2") returned 4
	[0091.753] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0091.753] lstrlenW (lpString=".7z") returned 3
	[0091.754] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0091.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.754] lstrlenW (lpString=".dbf") returned 4
	[0091.754] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0091.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.754] lstrlenW (lpString=".1cd") returned 4
	[0091.754] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0091.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0091.754] lstrlenW (lpString=".jpg") returned 4
	[0091.755] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0091.755] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0091.755] lstrlenW (lpString="Proof.msi") returned 9
	[0091.756] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0091.756] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=885760) returned 1
	[0091.756] CloseHandle (hObject=0x1bc) returned 1
	[0091.757] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020
	[0091.757] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0091.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0091.757] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.757] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0091.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0091.758] GetLastError () returned 0x0
	[0091.758] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0xd8400, lpOverlapped=0x0) returned 1
	[0092.391] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xd8410, lpOverlapped=0x0) returned 1
	[0092.425] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0x0, lpOverlapped=0x0) returned 1
	[0092.425] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0092.425] SetEndOfFile (hFile=0x1f4) returned 1
	[0092.426] CloseHandle (hObject=0x1f4) returned 1
	[0092.437] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.437] SetEndOfFile (hFile=0x1bc) returned 1
	[0092.449] CloseHandle (hObject=0x1bc) returned 1
	[0092.449] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0092.450] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1
	[0092.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.451] lstrlenW (lpString=".doc") returned 4
	[0092.451] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0092.451] lstrlenW (lpString=".docx") returned 5
	[0092.451] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0092.452] lstrlenW (lpString=".pdf") returned 4
	[0092.452] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0092.452] lstrlenW (lpString=".xls") returned 4
	[0092.452] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0092.452] lstrlenW (lpString=".xlsx") returned 5
	[0092.452] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0092.452] lstrlenW (lpString=".ppt") returned 4
	[0092.457] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0092.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.457] lstrlenW (lpString=".zip") returned 4
	[0092.457] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0092.458] lstrlenW (lpString=".rar") returned 4
	[0092.458] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0092.458] lstrlenW (lpString=".bz2") returned 4
	[0092.458] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0092.458] lstrlenW (lpString=".7z") returned 3
	[0092.458] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0092.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.458] lstrlenW (lpString=".dbf") returned 4
	[0092.459] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0092.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.459] lstrlenW (lpString=".1cd") returned 4
	[0092.459] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0092.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.459] lstrlenW (lpString=".jpg") returned 4
	[0092.459] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0092.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.460] lstrlenW (lpString=".doc") returned 4
	[0092.460] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0092.460] lstrlenW (lpString=".docx") returned 5
	[0092.460] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0092.460] lstrlenW (lpString=".pdf") returned 4
	[0092.460] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0092.461] lstrlenW (lpString=".xls") returned 4
	[0092.461] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0092.461] lstrlenW (lpString=".xlsx") returned 5
	[0092.461] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0092.461] lstrlenW (lpString=".ppt") returned 4
	[0092.461] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0092.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.464] lstrlenW (lpString=".zip") returned 4
	[0092.464] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0092.464] lstrlenW (lpString=".rar") returned 4
	[0092.465] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0092.465] lstrlenW (lpString=".bz2") returned 4
	[0092.465] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0092.465] lstrlenW (lpString=".7z") returned 3
	[0092.465] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0092.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.465] lstrlenW (lpString=".dbf") returned 4
	[0092.466] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0092.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.466] lstrlenW (lpString=".1cd") returned 4
	[0092.466] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0092.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0092.466] lstrlenW (lpString=".jpg") returned 4
	[0092.466] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0092.467] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0092.467] lstrlenW (lpString="Office32MUI.msi") returned 15
	[0092.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0092.468] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=873984) returned 1
	[0092.468] CloseHandle (hObject=0x1bc) returned 1
	[0092.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020
	[0092.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0092.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0092.469] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.469] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0092.470] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0092.470] GetLastError () returned 0x0
	[0092.470] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0xd5600, lpOverlapped=0x0) returned 1
	[0094.341] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xd5610, lpOverlapped=0x0) returned 1
	[0095.072] ReadFile (in: hFile=0x1bc, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x390fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x390fed4*=0x0, lpOverlapped=0x0) returned 1
	[0095.072] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x390fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0095.073] SetEndOfFile (hFile=0x1f4) returned 1
	[0095.073] CloseHandle (hObject=0x1f4) returned 1
	[0095.089] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0095.090] SetEndOfFile (hFile=0x1bc) returned 1
	[0095.601] CloseHandle (hObject=0x1bc) returned 1
	[0095.601] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0095.711] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1
	[0095.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.712] lstrlenW (lpString=".doc") returned 4
	[0095.712] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0095.712] lstrlenW (lpString=".docx") returned 5
	[0095.712] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0095.712] lstrlenW (lpString=".pdf") returned 4
	[0095.712] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0095.712] lstrlenW (lpString=".xls") returned 4
	[0095.713] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0095.713] lstrlenW (lpString=".xlsx") returned 5
	[0095.713] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0095.713] lstrlenW (lpString=".ppt") returned 4
	[0095.713] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0095.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.713] lstrlenW (lpString=".zip") returned 4
	[0095.714] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0095.714] lstrlenW (lpString=".rar") returned 4
	[0095.714] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0095.714] lstrlenW (lpString=".bz2") returned 4
	[0095.714] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0095.714] lstrlenW (lpString=".7z") returned 3
	[0095.714] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0095.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.715] lstrlenW (lpString=".dbf") returned 4
	[0095.715] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0095.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.715] lstrlenW (lpString=".1cd") returned 4
	[0095.715] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0095.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.716] lstrlenW (lpString=".jpg") returned 4
	[0095.716] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0095.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.717] lstrlenW (lpString=".doc") returned 4
	[0095.717] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0095.717] lstrlenW (lpString=".docx") returned 5
	[0095.717] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0095.717] lstrlenW (lpString=".pdf") returned 4
	[0095.717] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0095.718] lstrlenW (lpString=".xls") returned 4
	[0095.718] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0095.718] lstrlenW (lpString=".xlsx") returned 5
	[0095.718] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0095.718] lstrlenW (lpString=".ppt") returned 4
	[0095.718] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0095.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.719] lstrlenW (lpString=".zip") returned 4
	[0095.719] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0095.719] lstrlenW (lpString=".rar") returned 4
	[0095.719] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0095.719] lstrlenW (lpString=".bz2") returned 4
	[0095.720] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0095.720] lstrlenW (lpString=".7z") returned 3
	[0095.720] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0095.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.720] lstrlenW (lpString=".dbf") returned 4
	[0095.720] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0095.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.721] lstrlenW (lpString=".1cd") returned 4
	[0095.721] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0095.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0095.721] lstrlenW (lpString=".jpg") returned 4
	[0095.721] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0095.722] lstrcmpiW (lpString1=".cab", lpString2=".lina") returned -1
	[0095.723] lstrlenW (lpString="InfLR.cab") returned 9
	[0095.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0095.724] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=18874884) returned 1
	[0095.724] CloseHandle (hObject=0x210) returned 1
	[0095.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020
	[0095.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0095.725] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0095.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0095.726] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0095.726] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0095.727] ReadFile (in: hFile=0x210, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.264] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.264] ReadFile (in: hFile=0x210, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.445] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0096.445] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0096.445] ReadFile (in: hFile=0x210, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0096.496] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0096.496] WriteFile (in: hFile=0x210, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0096.518] SetEndOfFile (hFile=0x210) returned 1
	[0096.518] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f73ff8
	[0096.979] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.979] WriteFile (in: hFile=0x210, lpBuffer=0x3f73ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.982] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.982] WriteFile (in: hFile=0x210, lpBuffer=0x3f73ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.991] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0096.991] WriteFile (in: hFile=0x210, lpBuffer=0x3f73ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73ff8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0096.997] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f73ff8 | out: hHeap=0x2e0000) returned 1
	[0097.000] CloseHandle (hObject=0x210) returned 1
	[0098.866] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0098.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.867] lstrlenW (lpString=".doc") returned 4
	[0098.867] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0098.867] lstrlenW (lpString=".docx") returned 5
	[0098.867] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0098.867] lstrlenW (lpString=".pdf") returned 4
	[0098.867] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0098.868] lstrlenW (lpString=".xls") returned 4
	[0098.868] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0098.868] lstrlenW (lpString=".xlsx") returned 5
	[0098.868] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0098.868] lstrlenW (lpString=".ppt") returned 4
	[0098.868] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0098.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.869] lstrlenW (lpString=".zip") returned 4
	[0098.869] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0098.869] lstrlenW (lpString=".rar") returned 4
	[0098.869] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0098.869] lstrlenW (lpString=".bz2") returned 4
	[0098.869] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0098.869] lstrlenW (lpString=".7z") returned 3
	[0098.870] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0098.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.870] lstrlenW (lpString=".dbf") returned 4
	[0098.870] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0098.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.870] lstrlenW (lpString=".1cd") returned 4
	[0098.870] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0098.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.871] lstrlenW (lpString=".jpg") returned 4
	[0098.871] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0098.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.871] lstrlenW (lpString=".doc") returned 4
	[0098.872] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0098.872] lstrlenW (lpString=".docx") returned 5
	[0098.872] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0098.872] lstrlenW (lpString=".pdf") returned 4
	[0098.872] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0098.872] lstrlenW (lpString=".xls") returned 4
	[0098.872] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0098.873] lstrlenW (lpString=".xlsx") returned 5
	[0098.873] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0098.880] lstrlenW (lpString=".ppt") returned 4
	[0098.881] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0098.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.881] lstrlenW (lpString=".zip") returned 4
	[0098.881] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0098.881] lstrlenW (lpString=".rar") returned 4
	[0098.881] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0098.881] lstrlenW (lpString=".bz2") returned 4
	[0098.882] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0098.882] lstrlenW (lpString=".7z") returned 3
	[0098.882] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0098.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.882] lstrlenW (lpString=".dbf") returned 4
	[0098.882] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0098.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.883] lstrlenW (lpString=".1cd") returned 4
	[0098.883] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0098.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0098.883] lstrlenW (lpString=".jpg") returned 4
	[0098.883] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0098.884] lstrcmpiW (lpString1=".msi", lpString2=".lina") returned 1
	[0098.884] lstrlenW (lpString="VisioMUI.msi") returned 12
	[0098.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0098.888] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x390ff1c | out: lpFileSize=0x390ff1c*=2797568) returned 1
	[0098.889] CloseHandle (hObject=0x210) returned 1
	[0098.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020
	[0098.890] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 0xffffffff
	[0098.890] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[linajamser@aol.com].lina")) returned 1
	[0098.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[linajamser@aol.com].lina" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[linajamser@aol.com].lina"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0098.892] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0x0) returned 1
	[0098.893] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0098.893] ReadFile (in: hFile=0x210, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.030] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.031] ReadFile (in: hFile=0x210, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.089] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x390fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0099.089] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x390fc2c | out: lpNewFilePointer=0x0) returned 1
	[0099.089] ReadFile (in: hFile=0x210, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x390fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x390fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0099.254] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fec8 | out: lpNewFilePointer=0x0) returned 1
	[0099.254] WriteFile (in: hFile=0x210, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x390fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x390fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0099.572] SetEndOfFile (hFile=0x210) returned 1
	[0099.572] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ef3fe8
	[0099.588] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.588] WriteFile (in: hFile=0x210, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.617] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.617] WriteFile (in: hFile=0x210, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.626] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x390fc7c | out: lpNewFilePointer=0x0) returned 1
	[0099.626] WriteFile (in: hFile=0x210, lpBuffer=0x3ef3fe8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x390fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef3fe8*, lpNumberOfBytesWritten=0x390fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0099.629] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ef3fe8 | out: hHeap=0x2e0000) returned 1
	[0099.629] CloseHandle (hObject=0x210) returned 1
	[0099.630] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[linajamser@aol.com].lina", dwFileAttributes=0x2020) returned 1
	[0099.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.631] lstrlenW (lpString=".doc") returned 4
	[0099.631] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.631] lstrlenW (lpString=".docx") returned 5
	[0099.631] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.631] lstrlenW (lpString=".pdf") returned 4
	[0099.632] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.632] lstrlenW (lpString=".xls") returned 4
	[0099.632] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.632] lstrlenW (lpString=".xlsx") returned 5
	[0099.632] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.632] lstrlenW (lpString=".ppt") returned 4
	[0099.632] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.633] lstrlenW (lpString=".zip") returned 4
	[0099.633] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.633] lstrlenW (lpString=".rar") returned 4
	[0099.633] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0099.633] lstrlenW (lpString=".bz2") returned 4
	[0099.633] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0099.634] lstrlenW (lpString=".7z") returned 3
	[0099.634] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0099.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.634] lstrlenW (lpString=".dbf") returned 4
	[0099.634] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0099.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.634] lstrlenW (lpString=".1cd") returned 4
	[0099.634] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0099.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.635] lstrlenW (lpString=".jpg") returned 4
	[0099.635] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0099.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.635] lstrlenW (lpString=".doc") returned 4
	[0099.635] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0099.636] lstrlenW (lpString=".docx") returned 5
	[0099.636] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0099.636] lstrlenW (lpString=".pdf") returned 4
	[0099.636] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0099.636] lstrlenW (lpString=".xls") returned 4
	[0099.636] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0099.636] lstrlenW (lpString=".xlsx") returned 5
	[0099.636] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0099.636] lstrlenW (lpString=".ppt") returned 4
	[0099.636] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0099.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0099.637] lstrlenW (lpString=".zip") returned 4
	[0099.637] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0099.637] lstrlenW (lpString=".rar") returned 4
	[0099.637] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1

Thread:
	id = 19
	os_tid = 0x25c

	[0072.698] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3600068
	[0072.698] lstrlenW (lpString="C:") returned 2
	[0072.698] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a4fd00 | out: lpFindFileData=0x3a4fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x331638
	[0072.699] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0072.699] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0072.699] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0072.700] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0072.700] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3694528
	[0072.701] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0072.701] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331678
	[0072.702] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.702] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0072.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0072.702] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0072.703] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0072.703] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0072.703] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0072.704] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0072.704] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33ab10
	[0072.705] FindNextFileW (in: hFindFile=0x33ab10, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.705] FindNextFileW (in: hFindFile=0x33ab10, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0072.705] lstrlenW (lpString="desktop.ini") returned 11
	[0072.705] lstrlenW (lpString=".1cd") returned 4
	[0072.705] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0072.706] lstrlenW (lpString=".3ds") returned 4
	[0072.706] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0072.706] lstrlenW (lpString=".3fr") returned 4
	[0072.706] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0072.706] lstrlenW (lpString=".3g2") returned 4
	[0072.706] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0072.707] lstrlenW (lpString=".3gp") returned 4
	[0072.707] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0072.707] lstrlenW (lpString=".7z") returned 3
	[0072.707] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0072.707] lstrlenW (lpString=".accda") returned 6
	[0072.707] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0072.708] lstrlenW (lpString=".accdb") returned 6
	[0072.708] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0072.708] lstrlenW (lpString=".accdc") returned 6
	[0072.708] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0072.708] lstrlenW (lpString=".accde") returned 6
	[0072.708] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0072.709] lstrlenW (lpString=".accdt") returned 6
	[0072.709] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0072.709] lstrlenW (lpString=".accdw") returned 6
	[0072.709] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0072.709] lstrlenW (lpString=".adb") returned 4
	[0072.709] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0072.710] lstrlenW (lpString=".adp") returned 4
	[0072.710] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0072.710] lstrlenW (lpString=".ai") returned 3
	[0072.710] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0072.710] lstrlenW (lpString=".ai3") returned 4
	[0072.710] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0072.710] lstrlenW (lpString=".ai4") returned 4
	[0072.711] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0072.711] lstrlenW (lpString=".ai5") returned 4
	[0072.711] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0072.711] lstrlenW (lpString=".ai6") returned 4
	[0072.711] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0072.711] lstrlenW (lpString=".ai7") returned 4
	[0072.712] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0072.712] lstrlenW (lpString=".ai8") returned 4
	[0072.712] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0072.713] lstrlenW (lpString=".anim") returned 5
	[0072.713] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0072.713] lstrlenW (lpString=".arw") returned 4
	[0072.713] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0072.713] lstrlenW (lpString=".as") returned 3
	[0072.713] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0072.714] lstrlenW (lpString=".asa") returned 4
	[0072.714] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0072.714] lstrlenW (lpString=".asc") returned 4
	[0072.714] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0072.714] lstrlenW (lpString=".ascx") returned 5
	[0072.714] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0072.715] lstrlenW (lpString=".asm") returned 4
	[0072.715] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0072.715] lstrlenW (lpString=".asmx") returned 5
	[0072.715] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0072.715] lstrlenW (lpString=".asp") returned 4
	[0072.715] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0072.716] lstrlenW (lpString=".aspx") returned 5
	[0072.716] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0072.716] lstrlenW (lpString=".asr") returned 4
	[0072.716] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0072.716] lstrlenW (lpString=".asx") returned 4
	[0072.716] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0072.717] lstrlenW (lpString=".avi") returned 4
	[0072.717] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0072.717] lstrlenW (lpString=".avs") returned 4
	[0072.717] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0072.717] lstrlenW (lpString=".backup") returned 7
	[0072.717] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0072.717] lstrlenW (lpString=".bak") returned 4
	[0072.718] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0072.718] lstrlenW (lpString=".bay") returned 4
	[0072.718] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0072.718] lstrlenW (lpString=".bd") returned 3
	[0072.718] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0072.718] lstrlenW (lpString=".bin") returned 4
	[0072.719] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0072.719] lstrlenW (lpString=".bmp") returned 4
	[0072.719] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0072.719] lstrlenW (lpString=".bz2") returned 4
	[0072.719] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0072.719] lstrlenW (lpString=".c") returned 2
	[0072.720] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0072.720] lstrlenW (lpString=".cdr") returned 4
	[0072.720] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0072.720] lstrlenW (lpString=".cer") returned 4
	[0072.720] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0072.720] lstrlenW (lpString=".cf") returned 3
	[0072.720] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0072.721] lstrlenW (lpString=".cfc") returned 4
	[0072.721] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0072.721] lstrlenW (lpString=".cfm") returned 4
	[0072.721] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0072.721] lstrlenW (lpString=".cfml") returned 5
	[0072.721] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0072.721] lstrlenW (lpString=".cfu") returned 4
	[0072.722] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0072.722] lstrlenW (lpString=".chm") returned 4
	[0072.722] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0072.722] lstrlenW (lpString=".cin") returned 4
	[0072.722] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0072.722] lstrlenW (lpString=".class") returned 6
	[0072.723] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0072.723] lstrlenW (lpString=".clx") returned 4
	[0072.723] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0072.723] lstrlenW (lpString=".config") returned 7
	[0072.723] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0072.723] lstrlenW (lpString=".cpp") returned 4
	[0072.723] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0072.724] lstrlenW (lpString=".cr2") returned 4
	[0072.724] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0072.724] lstrlenW (lpString=".crt") returned 4
	[0072.724] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0072.724] lstrlenW (lpString=".crw") returned 4
	[0072.724] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0072.725] lstrlenW (lpString=".cs") returned 3
	[0072.725] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0072.725] lstrlenW (lpString=".css") returned 4
	[0072.725] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0072.725] lstrlenW (lpString=".csv") returned 4
	[0072.725] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0072.725] lstrlenW (lpString=".cub") returned 4
	[0072.726] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0072.726] lstrlenW (lpString=".dae") returned 4
	[0072.726] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0072.726] lstrlenW (lpString=".dat") returned 4
	[0072.726] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0072.726] lstrlenW (lpString=".db") returned 3
	[0072.727] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0072.727] lstrlenW (lpString=".dbf") returned 4
	[0072.727] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0072.727] lstrlenW (lpString=".dbx") returned 4
	[0072.727] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0072.728] lstrlenW (lpString=".dc3") returned 4
	[0072.728] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0072.728] lstrlenW (lpString=".dcm") returned 4
	[0072.728] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0072.728] lstrlenW (lpString=".dcr") returned 4
	[0072.728] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0072.729] lstrlenW (lpString=".der") returned 4
	[0072.729] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0072.729] lstrlenW (lpString=".dib") returned 4
	[0072.729] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0072.729] lstrlenW (lpString=".dic") returned 4
	[0072.729] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0072.730] lstrlenW (lpString=".dif") returned 4
	[0072.730] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0072.730] lstrlenW (lpString=".divx") returned 5
	[0072.730] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0072.730] lstrlenW (lpString=".djvu") returned 5
	[0072.730] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0072.730] lstrlenW (lpString=".dng") returned 4
	[0072.731] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0072.731] lstrlenW (lpString=".doc") returned 4
	[0072.731] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0072.731] lstrlenW (lpString=".docm") returned 5
	[0072.731] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0072.731] lstrlenW (lpString=".docx") returned 5
	[0072.731] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0072.732] lstrlenW (lpString=".dot") returned 4
	[0072.732] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0072.732] lstrlenW (lpString=".dotm") returned 5
	[0072.732] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0072.732] lstrlenW (lpString=".dotx") returned 5
	[0072.732] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0072.733] lstrlenW (lpString=".dpx") returned 4
	[0072.733] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0072.733] lstrlenW (lpString=".dqy") returned 4
	[0072.733] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0072.733] lstrlenW (lpString=".dsn") returned 4
	[0072.733] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0072.733] lstrlenW (lpString=".dt") returned 3
	[0072.734] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0072.734] lstrlenW (lpString=".dtd") returned 4
	[0072.734] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0072.734] lstrlenW (lpString=".dwg") returned 4
	[0072.734] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0072.734] lstrlenW (lpString=".dwt") returned 4
	[0072.735] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0072.735] lstrlenW (lpString=".dx") returned 3
	[0072.735] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0072.735] lstrlenW (lpString=".dxf") returned 4
	[0072.735] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0072.735] lstrlenW (lpString=".edml") returned 5
	[0072.736] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0072.736] lstrlenW (lpString=".efd") returned 4
	[0072.736] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0072.736] lstrlenW (lpString=".elf") returned 4
	[0072.736] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0072.736] lstrlenW (lpString=".emf") returned 4
	[0072.737] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0072.737] lstrlenW (lpString=".emz") returned 4
	[0072.737] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0072.737] lstrlenW (lpString=".epf") returned 4
	[0072.737] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0072.737] lstrlenW (lpString=".eps") returned 4
	[0072.738] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0072.738] lstrlenW (lpString=".epsf") returned 5
	[0072.738] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0072.738] lstrlenW (lpString=".epsp") returned 5
	[0072.738] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0072.738] lstrlenW (lpString=".erf") returned 4
	[0072.738] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0072.739] lstrlenW (lpString=".exr") returned 4
	[0072.739] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0072.739] lstrlenW (lpString=".f4v") returned 4
	[0072.739] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0072.739] lstrlenW (lpString=".fido") returned 5
	[0072.739] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0072.739] lstrlenW (lpString=".flm") returned 4
	[0072.740] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0072.740] lstrlenW (lpString=".flv") returned 4
	[0072.740] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0072.740] lstrlenW (lpString=".frm") returned 4
	[0072.740] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0072.740] lstrlenW (lpString=".fxg") returned 4
	[0072.741] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0072.741] lstrlenW (lpString=".geo") returned 4
	[0072.741] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0072.741] lstrlenW (lpString=".gif") returned 4
	[0072.741] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0072.741] lstrlenW (lpString=".grs") returned 4
	[0072.741] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0072.742] lstrlenW (lpString=".gz") returned 3
	[0072.742] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0072.742] lstrlenW (lpString=".h") returned 2
	[0072.742] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0072.742] lstrlenW (lpString=".hdr") returned 4
	[0072.742] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0072.743] lstrlenW (lpString=".hpp") returned 4
	[0072.743] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0072.743] lstrlenW (lpString=".hta") returned 4
	[0073.281] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0073.282] lstrlenW (lpString=".htc") returned 4
	[0073.282] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0073.282] lstrlenW (lpString=".htm") returned 4
	[0073.282] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0073.282] lstrlenW (lpString=".html") returned 5
	[0073.282] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0073.283] lstrlenW (lpString=".icb") returned 4
	[0073.283] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0073.283] lstrlenW (lpString=".ics") returned 4
	[0073.283] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0073.283] lstrlenW (lpString=".iff") returned 4
	[0073.284] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0073.284] lstrlenW (lpString=".inc") returned 4
	[0073.284] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0073.284] lstrlenW (lpString=".indd") returned 5
	[0073.284] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0073.285] lstrlenW (lpString=".ini") returned 4
	[0073.285] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0073.285] FindNextFileW (in: hFindFile=0x33ab10, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0073.285] FindClose (in: hFindFile=0x33ab10 | out: hFindFile=0x33ab10) returned 1
	[0073.341] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0073.341] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0073.341] FindClose (in: hFindFile=0x331678 | out: hFindFile=0x331678) returned 1
	[0073.341] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3694528 | out: hHeap=0x2e0000) returned 1
	[0073.342] FindNextFileW (in: hFindFile=0x331638, lpFindFileData=0x3a4fd00 | out: lpFindFileData=0x3a4fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0073.342] lstrlenW (lpString="C:\\Boot") returned 7
	[0073.342] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0073.343] lstrlenW (lpString="Boot") returned 4
	[0073.343] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0073.343] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3694528
	[0073.343] lstrlenW (lpString="C:\\Boot") returned 7
	[0073.343] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331678
	[0073.344] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.344] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0073.344] lstrlenW (lpString="BCD") returned 3
	[0073.344] lstrlenW (lpString=".1cd") returned 4
	[0073.345] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0073.345] lstrlenW (lpString=".3ds") returned 4
	[0073.345] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0073.345] lstrlenW (lpString=".3fr") returned 4
	[0073.345] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0073.345] lstrlenW (lpString=".3g2") returned 4
	[0073.345] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0073.346] lstrlenW (lpString=".3gp") returned 4
	[0073.346] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0073.346] lstrlenW (lpString=".7z") returned 3
	[0073.346] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0073.346] lstrlenW (lpString=".accda") returned 6
	[0073.346] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0073.347] lstrlenW (lpString=".accdb") returned 6
	[0073.347] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0073.347] lstrlenW (lpString=".accdc") returned 6
	[0073.347] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0073.347] lstrlenW (lpString=".accde") returned 6
	[0073.347] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0073.348] lstrlenW (lpString=".accdt") returned 6
	[0073.348] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0073.348] lstrlenW (lpString=".accdw") returned 6
	[0073.348] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0073.348] lstrlenW (lpString=".adb") returned 4
	[0073.348] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0073.349] lstrlenW (lpString=".adp") returned 4
	[0073.349] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0073.349] lstrlenW (lpString=".ai") returned 3
	[0073.349] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0073.349] lstrlenW (lpString=".ai3") returned 4
	[0073.349] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0073.349] lstrlenW (lpString=".ai4") returned 4
	[0073.350] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0073.350] lstrlenW (lpString=".ai5") returned 4
	[0073.350] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0073.350] lstrlenW (lpString=".ai6") returned 4
	[0073.350] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0073.350] lstrlenW (lpString=".ai7") returned 4
	[0073.350] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0073.351] lstrlenW (lpString=".ai8") returned 4
	[0073.351] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0073.351] lstrlenW (lpString=".anim") returned 5
	[0073.351] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0073.351] lstrlenW (lpString=".arw") returned 4
	[0073.352] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0073.352] lstrlenW (lpString=".as") returned 3
	[0073.352] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0073.352] lstrlenW (lpString=".asa") returned 4
	[0073.352] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0073.352] lstrlenW (lpString=".asc") returned 4
	[0073.352] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0073.353] lstrlenW (lpString=".ascx") returned 5
	[0073.353] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0073.353] lstrlenW (lpString=".asm") returned 4
	[0073.353] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0073.353] lstrlenW (lpString=".asmx") returned 5
	[0073.353] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0073.353] lstrlenW (lpString=".asp") returned 4
	[0073.354] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0073.354] lstrlenW (lpString=".aspx") returned 5
	[0073.354] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0073.354] lstrlenW (lpString=".asr") returned 4
	[0073.354] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0073.354] lstrlenW (lpString=".asx") returned 4
	[0073.355] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0073.355] lstrlenW (lpString=".avi") returned 4
	[0073.355] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0073.355] lstrlenW (lpString=".avs") returned 4
	[0073.355] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0073.355] lstrlenW (lpString=".backup") returned 7
	[0073.356] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0073.356] lstrlenW (lpString=".bak") returned 4
	[0073.356] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0073.356] lstrlenW (lpString=".bay") returned 4
	[0073.356] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0073.357] lstrlenW (lpString=".bd") returned 3
	[0073.357] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0073.357] lstrlenW (lpString=".bin") returned 4
	[0073.357] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0073.357] lstrlenW (lpString=".bmp") returned 4
	[0073.357] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0073.358] lstrlenW (lpString=".bz2") returned 4
	[0073.358] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0073.358] lstrlenW (lpString=".c") returned 2
	[0073.358] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0073.358] lstrlenW (lpString=".cdr") returned 4
	[0073.358] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0073.359] lstrlenW (lpString=".cer") returned 4
	[0073.359] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0073.359] lstrlenW (lpString=".cf") returned 3
	[0073.359] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0073.359] lstrlenW (lpString=".cfc") returned 4
	[0073.359] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0073.360] lstrlenW (lpString=".cfm") returned 4
	[0073.360] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0073.360] lstrlenW (lpString=".cfml") returned 5
	[0073.360] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0073.360] lstrlenW (lpString=".cfu") returned 4
	[0073.360] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0073.361] lstrlenW (lpString=".chm") returned 4
	[0073.361] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0073.361] lstrlenW (lpString=".cin") returned 4
	[0073.361] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0073.361] lstrlenW (lpString=".class") returned 6
	[0073.361] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0073.362] lstrlenW (lpString=".clx") returned 4
	[0073.362] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0073.362] lstrlenW (lpString=".config") returned 7
	[0073.362] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0073.362] lstrlenW (lpString=".cpp") returned 4
	[0073.362] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0073.362] lstrlenW (lpString=".cr2") returned 4
	[0073.363] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0073.363] lstrlenW (lpString=".crt") returned 4
	[0073.363] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0073.363] lstrlenW (lpString=".crw") returned 4
	[0073.363] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0073.364] lstrlenW (lpString=".cs") returned 3
	[0073.364] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0073.364] lstrlenW (lpString=".css") returned 4
	[0073.364] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0073.364] lstrlenW (lpString=".csv") returned 4
	[0073.364] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0073.365] lstrlenW (lpString=".cub") returned 4
	[0073.365] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0073.365] lstrlenW (lpString=".dae") returned 4
	[0073.365] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0073.365] lstrlenW (lpString=".dat") returned 4
	[0073.365] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0073.366] lstrlenW (lpString=".db") returned 3
	[0073.366] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0073.366] lstrlenW (lpString=".dbf") returned 4
	[0073.366] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0073.366] lstrlenW (lpString=".dbx") returned 4
	[0073.367] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0073.367] lstrlenW (lpString=".dc3") returned 4
	[0073.367] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0073.368] lstrlenW (lpString=".dcm") returned 4
	[0073.368] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0073.368] lstrlenW (lpString=".dcr") returned 4
	[0073.368] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0073.368] lstrlenW (lpString=".der") returned 4
	[0073.368] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0073.369] lstrlenW (lpString=".dib") returned 4
	[0073.369] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0073.369] lstrlenW (lpString=".dic") returned 4
	[0073.369] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0073.369] lstrlenW (lpString=".dif") returned 4
	[0073.369] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0073.370] lstrlenW (lpString=".divx") returned 5
	[0073.370] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0073.370] lstrlenW (lpString=".djvu") returned 5
	[0073.370] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0073.370] lstrlenW (lpString=".dng") returned 4
	[0073.371] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0073.371] lstrlenW (lpString=".doc") returned 4
	[0073.371] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0073.371] lstrlenW (lpString=".docm") returned 5
	[0073.371] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0073.371] lstrlenW (lpString=".docx") returned 5
	[0073.372] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0073.372] lstrlenW (lpString=".dot") returned 4
	[0073.372] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0073.372] lstrlenW (lpString=".dotm") returned 5
	[0073.372] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0073.372] lstrlenW (lpString=".dotx") returned 5
	[0073.373] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0073.373] lstrlenW (lpString=".dpx") returned 4
	[0073.373] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0073.373] lstrlenW (lpString=".dqy") returned 4
	[0073.373] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0073.374] lstrlenW (lpString=".dsn") returned 4
	[0073.374] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0073.374] lstrlenW (lpString=".dt") returned 3
	[0073.374] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0073.374] lstrlenW (lpString=".dtd") returned 4
	[0073.374] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0073.374] lstrlenW (lpString=".dwg") returned 4
	[0073.375] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0073.375] lstrlenW (lpString=".dwt") returned 4
	[0073.375] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0073.375] lstrlenW (lpString=".dx") returned 3
	[0073.375] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0073.375] lstrlenW (lpString=".dxf") returned 4
	[0073.376] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0073.376] lstrlenW (lpString=".edml") returned 5
	[0073.376] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0073.376] lstrlenW (lpString=".efd") returned 4
	[0073.376] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0073.376] lstrlenW (lpString=".elf") returned 4
	[0073.377] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0073.377] lstrlenW (lpString=".emf") returned 4
	[0073.377] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0073.377] lstrlenW (lpString=".emz") returned 4
	[0073.377] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0073.377] lstrlenW (lpString=".epf") returned 4
	[0073.378] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0073.378] lstrlenW (lpString=".eps") returned 4
	[0073.378] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0073.378] lstrlenW (lpString=".epsf") returned 5
	[0073.378] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0073.378] lstrlenW (lpString=".epsp") returned 5
	[0073.379] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0073.379] lstrlenW (lpString=".erf") returned 4
	[0073.379] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0073.379] lstrlenW (lpString=".exr") returned 4
	[0073.379] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0073.380] lstrlenW (lpString=".f4v") returned 4
	[0073.380] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0073.380] lstrlenW (lpString=".fido") returned 5
	[0073.380] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0073.380] lstrlenW (lpString=".flm") returned 4
	[0073.380] lstrcmpiW (lpString1=".flm", lpString2="") returned 1
	[0073.381] lstrlenW (lpString=".flv") returned 4
	[0073.381] lstrcmpiW (lpString1=".flv", lpString2="") returned 1
	[0073.381] lstrlenW (lpString=".frm") returned 4
	[0073.381] lstrcmpiW (lpString1=".frm", lpString2="") returned 1
	[0073.381] lstrlenW (lpString=".fxg") returned 4
	[0073.381] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1
	[0073.382] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0073.382] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0074.944] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.944] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0074.945] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0074.945] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0074.945] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0074.946] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0074.946] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0074.947] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.947] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0074.948] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0074.948] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0074.948] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0074.949] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0074.949] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0075.037] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.038] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.038] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0075.039] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0075.039] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0075.039] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0075.039] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0075.040] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.040] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.041] FindClose (in: hFindFile=0x33b310 | out: hFindFile=0x33b310) returned 1
	[0075.041] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0075.041] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0075.042] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0075.042] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.092] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.092] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.093] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0075.093] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0075.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0075.094] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.152] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.152] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.153] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.153] lstrlenW (lpString=".1cd") returned 4
	[0075.153] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.153] lstrlenW (lpString=".3ds") returned 4
	[0075.153] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0075.153] lstrlenW (lpString=".3fr") returned 4
	[0075.153] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0075.154] lstrlenW (lpString=".3g2") returned 4
	[0075.154] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0075.154] lstrlenW (lpString=".3gp") returned 4
	[0075.154] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0075.154] lstrlenW (lpString=".7z") returned 3
	[0075.154] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.154] lstrlenW (lpString=".accda") returned 6
	[0075.155] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0075.155] lstrlenW (lpString=".accdb") returned 6
	[0075.155] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0075.155] lstrlenW (lpString=".accdc") returned 6
	[0075.155] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0075.155] lstrlenW (lpString=".accde") returned 6
	[0075.155] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0075.156] lstrlenW (lpString=".accdt") returned 6
	[0075.156] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0075.156] lstrlenW (lpString=".accdw") returned 6
	[0075.156] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0075.156] lstrlenW (lpString=".adb") returned 4
	[0075.156] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0075.156] lstrlenW (lpString=".adp") returned 4
	[0075.157] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0075.157] lstrlenW (lpString=".ai") returned 3
	[0075.157] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0075.157] lstrlenW (lpString=".ai3") returned 4
	[0075.157] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0075.157] lstrlenW (lpString=".ai4") returned 4
	[0075.157] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0075.157] lstrlenW (lpString=".ai5") returned 4
	[0075.158] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0075.158] lstrlenW (lpString=".ai6") returned 4
	[0075.158] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0075.158] lstrlenW (lpString=".ai7") returned 4
	[0075.158] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0075.158] lstrlenW (lpString=".ai8") returned 4
	[0075.158] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0075.159] lstrlenW (lpString=".anim") returned 5
	[0075.159] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0075.159] lstrlenW (lpString=".arw") returned 4
	[0075.159] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0075.160] lstrlenW (lpString=".as") returned 3
	[0075.160] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0075.160] lstrlenW (lpString=".asa") returned 4
	[0075.160] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0075.160] lstrlenW (lpString=".asc") returned 4
	[0075.160] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0075.160] lstrlenW (lpString=".ascx") returned 5
	[0075.161] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0075.161] lstrlenW (lpString=".asm") returned 4
	[0075.161] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0075.161] lstrlenW (lpString=".asmx") returned 5
	[0075.162] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0075.162] lstrlenW (lpString=".asp") returned 4
	[0075.162] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0075.162] lstrlenW (lpString=".aspx") returned 5
	[0075.162] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0075.162] lstrlenW (lpString=".asr") returned 4
	[0075.162] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0075.163] lstrlenW (lpString=".asx") returned 4
	[0075.163] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0075.163] lstrlenW (lpString=".avi") returned 4
	[0075.163] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0075.163] lstrlenW (lpString=".avs") returned 4
	[0075.163] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0075.164] lstrlenW (lpString=".backup") returned 7
	[0075.164] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0075.164] lstrlenW (lpString=".bak") returned 4
	[0075.164] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0075.164] lstrlenW (lpString=".bay") returned 4
	[0075.164] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0075.164] lstrlenW (lpString=".bd") returned 3
	[0075.165] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0075.165] lstrlenW (lpString=".bin") returned 4
	[0075.165] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0075.165] lstrlenW (lpString=".bmp") returned 4
	[0075.165] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0075.165] lstrlenW (lpString=".bz2") returned 4
	[0075.166] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.166] lstrlenW (lpString=".c") returned 2
	[0075.166] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0075.166] lstrlenW (lpString=".cdr") returned 4
	[0075.166] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0075.166] lstrlenW (lpString=".cer") returned 4
	[0075.167] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0075.167] lstrlenW (lpString=".cf") returned 3
	[0075.167] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0075.167] lstrlenW (lpString=".cfc") returned 4
	[0075.167] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0075.167] lstrlenW (lpString=".cfm") returned 4
	[0075.167] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0075.168] lstrlenW (lpString=".cfml") returned 5
	[0075.168] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0075.168] lstrlenW (lpString=".cfu") returned 4
	[0075.168] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0075.168] lstrlenW (lpString=".chm") returned 4
	[0075.168] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0075.168] lstrlenW (lpString=".cin") returned 4
	[0075.169] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0075.169] lstrlenW (lpString=".class") returned 6
	[0075.169] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0075.169] lstrlenW (lpString=".clx") returned 4
	[0075.169] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0075.169] lstrlenW (lpString=".config") returned 7
	[0075.170] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0075.170] lstrlenW (lpString=".cpp") returned 4
	[0075.170] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0075.170] lstrlenW (lpString=".cr2") returned 4
	[0075.170] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0075.170] lstrlenW (lpString=".crt") returned 4
	[0075.170] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0075.170] lstrlenW (lpString=".crw") returned 4
	[0075.171] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0075.171] lstrlenW (lpString=".cs") returned 3
	[0075.171] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0075.171] lstrlenW (lpString=".css") returned 4
	[0075.171] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0075.171] lstrlenW (lpString=".csv") returned 4
	[0075.172] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0075.172] lstrlenW (lpString=".cub") returned 4
	[0075.172] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0075.172] lstrlenW (lpString=".dae") returned 4
	[0075.172] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0075.172] lstrlenW (lpString=".dat") returned 4
	[0075.172] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0075.172] lstrlenW (lpString=".db") returned 3
	[0075.173] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0075.173] lstrlenW (lpString=".dbf") returned 4
	[0075.173] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.173] lstrlenW (lpString=".dbx") returned 4
	[0075.173] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0075.173] lstrlenW (lpString=".dc3") returned 4
	[0075.173] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0075.174] lstrlenW (lpString=".dcm") returned 4
	[0075.174] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0075.174] lstrlenW (lpString=".dcr") returned 4
	[0075.174] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0075.174] lstrlenW (lpString=".der") returned 4
	[0075.174] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0075.174] lstrlenW (lpString=".dib") returned 4
	[0075.175] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0075.175] lstrlenW (lpString=".dic") returned 4
	[0075.175] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0075.175] lstrlenW (lpString=".dif") returned 4
	[0075.176] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0075.176] lstrlenW (lpString=".divx") returned 5
	[0075.176] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0075.176] lstrlenW (lpString=".djvu") returned 5
	[0075.176] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0075.176] lstrlenW (lpString=".dng") returned 4
	[0075.176] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0075.177] lstrlenW (lpString=".doc") returned 4
	[0075.275] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.276] lstrlenW (lpString=".docm") returned 5
	[0075.276] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0075.276] lstrlenW (lpString=".docx") returned 5
	[0075.276] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.276] lstrlenW (lpString=".dot") returned 4
	[0075.276] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0075.277] lstrlenW (lpString=".dotm") returned 5
	[0075.277] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0075.277] lstrlenW (lpString=".dotx") returned 5
	[0075.277] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0075.277] lstrlenW (lpString=".dpx") returned 4
	[0075.277] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0075.278] lstrlenW (lpString=".dqy") returned 4
	[0075.278] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0075.278] lstrlenW (lpString=".dsn") returned 4
	[0075.278] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0075.278] lstrlenW (lpString=".dt") returned 3
	[0075.278] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0075.278] lstrlenW (lpString=".dtd") returned 4
	[0075.279] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0075.279] lstrlenW (lpString=".dwg") returned 4
	[0075.279] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0075.279] lstrlenW (lpString=".dwt") returned 4
	[0075.279] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0075.280] lstrlenW (lpString=".dx") returned 3
	[0075.280] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0075.280] lstrlenW (lpString=".dxf") returned 4
	[0075.280] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0075.280] lstrlenW (lpString=".edml") returned 5
	[0075.280] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0075.281] lstrlenW (lpString=".efd") returned 4
	[0075.281] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0075.281] lstrlenW (lpString=".elf") returned 4
	[0075.281] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0075.281] lstrlenW (lpString=".emf") returned 4
	[0075.281] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0075.282] lstrlenW (lpString=".emz") returned 4
	[0075.282] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0075.282] lstrlenW (lpString=".epf") returned 4
	[0075.282] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0075.282] lstrlenW (lpString=".eps") returned 4
	[0075.282] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0075.282] lstrlenW (lpString=".epsf") returned 5
	[0075.283] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0075.283] lstrlenW (lpString=".epsp") returned 5
	[0075.283] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0075.283] lstrlenW (lpString=".erf") returned 4
	[0075.283] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0075.283] lstrlenW (lpString=".exr") returned 4
	[0075.284] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0075.284] lstrlenW (lpString=".f4v") returned 4
	[0075.284] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0075.284] lstrlenW (lpString=".fido") returned 5
	[0075.284] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0075.284] lstrlenW (lpString=".flm") returned 4
	[0075.285] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0075.285] lstrlenW (lpString=".flv") returned 4
	[0075.285] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0075.285] lstrlenW (lpString=".frm") returned 4
	[0075.285] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0075.285] lstrlenW (lpString=".fxg") returned 4
	[0075.285] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0075.286] lstrlenW (lpString=".geo") returned 4
	[0075.286] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0075.287] lstrlenW (lpString=".gif") returned 4
	[0075.287] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0075.287] lstrlenW (lpString=".grs") returned 4
	[0075.287] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0075.287] lstrlenW (lpString=".gz") returned 3
	[0075.287] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0075.287] lstrlenW (lpString=".h") returned 2
	[0075.288] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0075.288] lstrlenW (lpString=".hdr") returned 4
	[0075.288] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0075.288] lstrlenW (lpString=".hpp") returned 4
	[0075.288] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0075.288] lstrlenW (lpString=".hta") returned 4
	[0075.289] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0075.289] lstrlenW (lpString=".htc") returned 4
	[0075.289] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0075.289] lstrlenW (lpString=".htm") returned 4
	[0075.289] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0075.289] lstrlenW (lpString=".html") returned 5
	[0075.289] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0075.290] lstrlenW (lpString=".icb") returned 4
	[0075.290] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0075.290] lstrlenW (lpString=".ics") returned 4
	[0075.290] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0075.290] lstrlenW (lpString=".iff") returned 4
	[0075.290] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0075.290] lstrlenW (lpString=".inc") returned 4
	[0075.291] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0075.291] lstrlenW (lpString=".indd") returned 5
	[0075.291] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0075.291] lstrlenW (lpString=".ini") returned 4
	[0075.291] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0075.291] lstrlenW (lpString=".iqy") returned 4
	[0075.291] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0075.292] lstrlenW (lpString=".j2c") returned 4
	[0075.292] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0075.292] lstrlenW (lpString=".j2k") returned 4
	[0075.292] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0075.292] lstrlenW (lpString=".java") returned 5
	[0075.292] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0075.292] lstrlenW (lpString=".jp2") returned 4
	[0075.293] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0075.293] lstrlenW (lpString=".jpc") returned 4
	[0075.293] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0075.293] lstrlenW (lpString=".jpe") returned 4
	[0075.293] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0075.293] lstrlenW (lpString=".jpeg") returned 5
	[0075.293] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0075.293] lstrlenW (lpString=".jpf") returned 4
	[0075.294] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0075.294] lstrlenW (lpString=".jpg") returned 4
	[0075.294] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.294] lstrlenW (lpString=".jpx") returned 4
	[0075.294] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0075.294] lstrlenW (lpString=".js") returned 3
	[0075.294] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0075.294] lstrlenW (lpString=".jsf") returned 4
	[0075.295] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0075.295] lstrlenW (lpString=".json") returned 5
	[0075.295] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0075.295] lstrlenW (lpString=".jsp") returned 4
	[0075.295] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0075.295] lstrlenW (lpString=".kdc") returned 4
	[0075.296] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0075.296] lstrlenW (lpString=".kmz") returned 4
	[0075.296] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0075.296] lstrlenW (lpString=".kwm") returned 4
	[0075.296] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0075.296] lstrlenW (lpString=".lasso") returned 6
	[0075.296] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0075.297] lstrlenW (lpString=".lbi") returned 4
	[0075.297] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0075.297] lstrlenW (lpString=".lgf") returned 4
	[0075.297] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0075.297] lstrlenW (lpString=".lgp") returned 4
	[0075.297] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0075.297] lstrlenW (lpString=".log") returned 4
	[0075.298] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0075.298] lstrlenW (lpString=".m1v") returned 4
	[0075.298] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0075.298] lstrlenW (lpString=".m4a") returned 4
	[0075.298] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0075.298] lstrlenW (lpString=".m4v") returned 4
	[0075.298] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0075.299] lstrlenW (lpString=".max") returned 4
	[0075.299] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0075.299] lstrlenW (lpString=".md") returned 3
	[0075.299] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0075.299] lstrlenW (lpString=".mda") returned 4
	[0075.299] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0075.299] lstrlenW (lpString=".mdb") returned 4
	[0075.300] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0075.300] lstrlenW (lpString=".mde") returned 4
	[0075.300] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0075.300] lstrlenW (lpString=".mdf") returned 4
	[0075.300] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0075.300] lstrlenW (lpString=".mdw") returned 4
	[0075.300] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0075.301] lstrlenW (lpString=".mef") returned 4
	[0075.301] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0075.301] lstrlenW (lpString=".mft") returned 4
	[0075.301] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0075.301] lstrlenW (lpString=".mfw") returned 4
	[0075.301] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0075.301] lstrlenW (lpString=".mht") returned 4
	[0075.302] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0075.302] lstrlenW (lpString=".mhtml") returned 6
	[0075.302] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0075.302] lstrlenW (lpString=".mka") returned 4
	[0075.302] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0075.302] lstrlenW (lpString=".mkidx") returned 6
	[0075.302] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0075.303] lstrlenW (lpString=".mkv") returned 4
	[0075.303] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0075.303] lstrlenW (lpString=".mos") returned 4
	[0075.303] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0075.303] lstrlenW (lpString=".mov") returned 4
	[0075.303] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0075.304] lstrlenW (lpString=".mp3") returned 4
	[0075.304] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0075.304] lstrlenW (lpString=".mp4") returned 4
	[0075.304] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0075.304] lstrlenW (lpString=".mpeg") returned 5
	[0075.304] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0075.305] lstrlenW (lpString=".mpg") returned 4
	[0075.305] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0075.305] lstrlenW (lpString=".mpv") returned 4
	[0075.305] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0075.305] lstrlenW (lpString=".mrw") returned 4
	[0075.305] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0075.305] lstrlenW (lpString=".msg") returned 4
	[0075.306] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0075.306] lstrlenW (lpString=".mxl") returned 4
	[0075.306] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0075.306] lstrlenW (lpString=".myd") returned 4
	[0075.306] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0075.306] lstrlenW (lpString=".myi") returned 4
	[0075.306] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0075.306] lstrlenW (lpString=".nef") returned 4
	[0075.307] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0075.307] lstrlenW (lpString=".nrw") returned 4
	[0075.307] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0075.307] lstrlenW (lpString=".obj") returned 4
	[0075.307] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0075.307] lstrlenW (lpString=".odb") returned 4
	[0075.308] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0075.308] lstrlenW (lpString=".odc") returned 4
	[0075.308] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0075.308] lstrlenW (lpString=".odm") returned 4
	[0075.308] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0075.308] lstrlenW (lpString=".odp") returned 4
	[0075.308] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0075.309] lstrlenW (lpString=".ods") returned 4
	[0075.309] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0075.309] lstrlenW (lpString=".oft") returned 4
	[0075.309] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0075.309] lstrlenW (lpString=".one") returned 4
	[0075.309] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0075.309] lstrlenW (lpString=".onepkg") returned 7
	[0075.310] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0075.310] lstrlenW (lpString=".onetoc2") returned 8
	[0075.310] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0075.310] lstrlenW (lpString=".opt") returned 4
	[0075.310] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0075.310] lstrlenW (lpString=".oqy") returned 4
	[0075.310] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0075.310] lstrlenW (lpString=".orf") returned 4
	[0075.311] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0075.311] lstrlenW (lpString=".p12") returned 4
	[0075.311] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0075.311] lstrlenW (lpString=".p7b") returned 4
	[0075.311] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0075.311] lstrlenW (lpString=".p7c") returned 4
	[0075.311] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0075.311] lstrlenW (lpString=".pam") returned 4
	[0075.312] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0075.312] lstrlenW (lpString=".pbm") returned 4
	[0075.312] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0075.312] lstrlenW (lpString=".pct") returned 4
	[0075.312] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0075.312] lstrlenW (lpString=".pcx") returned 4
	[0075.312] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0075.313] lstrlenW (lpString=".pdd") returned 4
	[0075.313] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0075.313] lstrlenW (lpString=".pdf") returned 4
	[0075.313] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.313] lstrlenW (lpString=".pdp") returned 4
	[0075.313] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0075.313] lstrlenW (lpString=".pef") returned 4
	[0075.313] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0075.314] lstrlenW (lpString=".pem") returned 4
	[0075.314] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0075.314] lstrlenW (lpString=".pff") returned 4
	[0075.314] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0075.314] lstrlenW (lpString=".pfm") returned 4
	[0075.314] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0075.314] lstrlenW (lpString=".pfx") returned 4
	[0075.315] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0075.315] lstrlenW (lpString=".pgm") returned 4
	[0075.315] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0075.315] lstrlenW (lpString=".php") returned 4
	[0075.315] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0075.315] lstrlenW (lpString=".php3") returned 5
	[0075.315] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0075.316] lstrlenW (lpString=".php4") returned 5
	[0075.316] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0075.316] lstrlenW (lpString=".php5") returned 5
	[0075.316] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0075.316] lstrlenW (lpString=".phtml") returned 6
	[0075.316] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0075.316] lstrlenW (lpString=".pict") returned 5
	[0075.317] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0075.317] lstrlenW (lpString=".pl") returned 3
	[0075.317] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0075.541] lstrlenW (lpString=".pls") returned 4
	[0075.541] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0075.541] lstrlenW (lpString=".pm") returned 3
	[0075.542] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0075.542] lstrlenW (lpString=".png") returned 4
	[0075.542] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0075.542] lstrlenW (lpString=".pnm") returned 4
	[0075.542] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0075.542] lstrlenW (lpString=".pot") returned 4
	[0075.542] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0075.543] lstrlenW (lpString=".potm") returned 5
	[0075.543] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0075.543] lstrlenW (lpString=".potx") returned 5
	[0075.543] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0075.543] lstrlenW (lpString=".ppa") returned 4
	[0075.543] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0075.544] lstrlenW (lpString=".ppam") returned 5
	[0075.544] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0075.544] lstrlenW (lpString=".ppm") returned 4
	[0075.544] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0075.544] lstrlenW (lpString=".pps") returned 4
	[0075.544] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0075.544] lstrlenW (lpString=".ppsm") returned 5
	[0075.545] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0075.545] lstrlenW (lpString=".ppt") returned 4
	[0075.545] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.545] lstrlenW (lpString=".pptm") returned 5
	[0075.545] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0075.545] lstrlenW (lpString=".pptx") returned 5
	[0075.545] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0075.546] lstrlenW (lpString=".prn") returned 4
	[0075.546] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0075.546] lstrlenW (lpString=".ps") returned 3
	[0075.546] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0075.546] lstrlenW (lpString=".psb") returned 4
	[0075.546] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0075.547] lstrlenW (lpString=".psd") returned 4
	[0075.547] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0075.547] lstrlenW (lpString=".pst") returned 4
	[0075.547] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0075.547] lstrlenW (lpString=".ptx") returned 4
	[0075.547] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0075.547] lstrlenW (lpString=".pub") returned 4
	[0075.548] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0075.548] lstrlenW (lpString=".pwm") returned 4
	[0075.548] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0075.548] lstrlenW (lpString=".pxr") returned 4
	[0075.548] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0075.548] lstrlenW (lpString=".py") returned 3
	[0075.548] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0075.549] lstrlenW (lpString=".qt") returned 3
	[0075.549] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0075.549] lstrlenW (lpString=".r3d") returned 4
	[0075.549] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0075.549] lstrlenW (lpString=".raf") returned 4
	[0075.549] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0075.550] lstrlenW (lpString=".rar") returned 4
	[0075.550] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.550] lstrlenW (lpString=".raw") returned 4
	[0075.550] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0075.550] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.551] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0075.551] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0075.552] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0075.552] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.552] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.553] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0075.553] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0075.553] lstrlenW (lpString=".1cd") returned 4
	[0075.553] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0075.553] lstrlenW (lpString=".3ds") returned 4
	[0075.554] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0075.554] lstrlenW (lpString=".3fr") returned 4
	[0075.554] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0075.554] lstrlenW (lpString=".3g2") returned 4
	[0075.554] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0075.554] lstrlenW (lpString=".3gp") returned 4
	[0075.555] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0075.555] lstrlenW (lpString=".7z") returned 3
	[0075.555] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0075.555] lstrlenW (lpString=".accda") returned 6
	[0075.555] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0075.555] lstrlenW (lpString=".accdb") returned 6
	[0075.556] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0075.556] lstrlenW (lpString=".accdc") returned 6
	[0075.556] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0075.556] lstrlenW (lpString=".accde") returned 6
	[0075.556] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0075.556] lstrlenW (lpString=".accdt") returned 6
	[0075.557] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0075.557] lstrlenW (lpString=".accdw") returned 6
	[0075.557] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0075.557] lstrlenW (lpString=".adb") returned 4
	[0075.557] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0075.557] lstrlenW (lpString=".adp") returned 4
	[0075.557] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0075.558] lstrlenW (lpString=".ai") returned 3
	[0075.558] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0075.558] lstrlenW (lpString=".ai3") returned 4
	[0075.558] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0075.558] lstrlenW (lpString=".ai4") returned 4
	[0075.558] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0075.558] lstrlenW (lpString=".ai5") returned 4
	[0075.559] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0075.559] lstrlenW (lpString=".ai6") returned 4
	[0075.559] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0075.559] lstrlenW (lpString=".ai7") returned 4
	[0075.559] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0075.559] lstrlenW (lpString=".ai8") returned 4
	[0075.560] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0075.560] lstrlenW (lpString=".anim") returned 5
	[0075.560] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0075.560] lstrlenW (lpString=".arw") returned 4
	[0075.560] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0075.560] lstrlenW (lpString=".as") returned 3
	[0075.561] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0075.561] lstrlenW (lpString=".asa") returned 4
	[0075.561] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0075.561] lstrlenW (lpString=".asc") returned 4
	[0075.561] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0075.561] lstrlenW (lpString=".ascx") returned 5
	[0075.562] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0075.562] lstrlenW (lpString=".asm") returned 4
	[0075.562] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0075.562] lstrlenW (lpString=".asmx") returned 5
	[0075.562] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0075.562] lstrlenW (lpString=".asp") returned 4
	[0075.562] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0075.563] lstrlenW (lpString=".aspx") returned 5
	[0075.563] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0075.563] lstrlenW (lpString=".asr") returned 4
	[0075.563] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0075.563] lstrlenW (lpString=".asx") returned 4
	[0075.563] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0075.564] lstrlenW (lpString=".avi") returned 4
	[0075.564] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0075.564] lstrlenW (lpString=".avs") returned 4
	[0075.564] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0075.564] lstrlenW (lpString=".backup") returned 7
	[0075.564] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0075.565] lstrlenW (lpString=".bak") returned 4
	[0075.565] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0075.565] lstrlenW (lpString=".bay") returned 4
	[0075.565] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0075.565] lstrlenW (lpString=".bd") returned 3
	[0075.566] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0075.566] lstrlenW (lpString=".bin") returned 4
	[0075.566] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0075.566] lstrlenW (lpString=".bmp") returned 4
	[0075.566] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0075.566] lstrlenW (lpString=".bz2") returned 4
	[0075.567] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0075.567] lstrlenW (lpString=".c") returned 2
	[0075.567] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0075.568] lstrlenW (lpString=".cdr") returned 4
	[0075.568] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0075.568] lstrlenW (lpString=".cer") returned 4
	[0075.568] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0075.568] lstrlenW (lpString=".cf") returned 3
	[0075.568] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0075.569] lstrlenW (lpString=".cfc") returned 4
	[0075.569] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0075.569] lstrlenW (lpString=".cfm") returned 4
	[0075.569] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0075.569] lstrlenW (lpString=".cfml") returned 5
	[0075.570] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0075.570] lstrlenW (lpString=".cfu") returned 4
	[0075.570] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0075.570] lstrlenW (lpString=".chm") returned 4
	[0075.570] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0075.570] lstrlenW (lpString=".cin") returned 4
	[0075.571] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0075.571] lstrlenW (lpString=".class") returned 6
	[0075.571] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0075.571] lstrlenW (lpString=".clx") returned 4
	[0075.571] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0075.571] lstrlenW (lpString=".config") returned 7
	[0075.572] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0075.572] lstrlenW (lpString=".cpp") returned 4
	[0075.572] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0075.572] lstrlenW (lpString=".cr2") returned 4
	[0075.572] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0075.572] lstrlenW (lpString=".crt") returned 4
	[0075.572] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0075.573] lstrlenW (lpString=".crw") returned 4
	[0075.573] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0075.573] lstrlenW (lpString=".cs") returned 3
	[0075.573] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0075.573] lstrlenW (lpString=".css") returned 4
	[0075.573] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0075.574] lstrlenW (lpString=".csv") returned 4
	[0075.574] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0075.574] lstrlenW (lpString=".cub") returned 4
	[0075.574] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0075.574] lstrlenW (lpString=".dae") returned 4
	[0075.575] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0075.575] lstrlenW (lpString=".dat") returned 4
	[0075.575] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0075.575] lstrlenW (lpString=".db") returned 3
	[0075.575] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0075.575] lstrlenW (lpString=".dbf") returned 4
	[0075.576] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0075.576] lstrlenW (lpString=".dbx") returned 4
	[0075.576] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0075.576] lstrlenW (lpString=".dc3") returned 4
	[0075.576] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0075.576] lstrlenW (lpString=".dcm") returned 4
	[0075.577] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0075.577] lstrlenW (lpString=".dcr") returned 4
	[0075.577] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0075.577] lstrlenW (lpString=".der") returned 4
	[0075.577] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0075.577] lstrlenW (lpString=".dib") returned 4
	[0075.578] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0075.578] lstrlenW (lpString=".dic") returned 4
	[0075.578] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0075.578] lstrlenW (lpString=".dif") returned 4
	[0075.578] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0075.578] lstrlenW (lpString=".divx") returned 5
	[0075.579] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0075.579] lstrlenW (lpString=".djvu") returned 5
	[0075.579] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0075.579] lstrlenW (lpString=".dng") returned 4
	[0075.579] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0075.579] lstrlenW (lpString=".doc") returned 4
	[0075.579] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0075.580] lstrlenW (lpString=".docm") returned 5
	[0075.580] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0075.580] lstrlenW (lpString=".docx") returned 5
	[0075.580] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0075.580] lstrlenW (lpString=".dot") returned 4
	[0075.580] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0075.581] lstrlenW (lpString=".dotm") returned 5
	[0075.581] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0075.581] lstrlenW (lpString=".dotx") returned 5
	[0075.581] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0075.581] lstrlenW (lpString=".dpx") returned 4
	[0075.581] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0075.582] lstrlenW (lpString=".dqy") returned 4
	[0075.582] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0075.582] lstrlenW (lpString=".dsn") returned 4
	[0075.582] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0075.582] lstrlenW (lpString=".dt") returned 3
	[0075.682] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0075.682] lstrlenW (lpString=".dtd") returned 4
	[0075.682] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0075.682] lstrlenW (lpString=".dwg") returned 4
	[0075.682] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0075.683] lstrlenW (lpString=".dwt") returned 4
	[0075.683] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0075.683] lstrlenW (lpString=".dx") returned 3
	[0075.683] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0075.683] lstrlenW (lpString=".dxf") returned 4
	[0075.683] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0075.684] lstrlenW (lpString=".edml") returned 5
	[0075.684] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0075.684] lstrlenW (lpString=".efd") returned 4
	[0075.684] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0075.684] lstrlenW (lpString=".elf") returned 4
	[0075.684] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0075.684] lstrlenW (lpString=".emf") returned 4
	[0075.685] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0075.685] lstrlenW (lpString=".emz") returned 4
	[0075.685] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0075.685] lstrlenW (lpString=".epf") returned 4
	[0075.685] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0075.685] lstrlenW (lpString=".eps") returned 4
	[0075.686] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0075.686] lstrlenW (lpString=".epsf") returned 5
	[0075.686] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0075.686] lstrlenW (lpString=".epsp") returned 5
	[0075.686] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0075.686] lstrlenW (lpString=".erf") returned 4
	[0075.687] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0075.687] lstrlenW (lpString=".exr") returned 4
	[0075.687] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0075.687] lstrlenW (lpString=".f4v") returned 4
	[0075.687] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0075.687] lstrlenW (lpString=".fido") returned 5
	[0075.688] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0075.688] lstrlenW (lpString=".flm") returned 4
	[0075.688] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0075.688] lstrlenW (lpString=".flv") returned 4
	[0075.688] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0075.688] lstrlenW (lpString=".frm") returned 4
	[0075.689] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0075.689] lstrlenW (lpString=".fxg") returned 4
	[0075.689] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0075.689] lstrlenW (lpString=".geo") returned 4
	[0075.689] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0075.689] lstrlenW (lpString=".gif") returned 4
	[0075.690] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0075.690] lstrlenW (lpString=".grs") returned 4
	[0075.690] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0075.690] lstrlenW (lpString=".gz") returned 3
	[0075.690] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0075.690] lstrlenW (lpString=".h") returned 2
	[0075.691] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0075.691] lstrlenW (lpString=".hdr") returned 4
	[0075.691] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0075.691] lstrlenW (lpString=".hpp") returned 4
	[0075.691] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0075.692] lstrlenW (lpString=".hta") returned 4
	[0075.692] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0075.692] lstrlenW (lpString=".htc") returned 4
	[0075.692] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0075.693] lstrlenW (lpString=".htm") returned 4
	[0075.693] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0075.693] lstrlenW (lpString=".html") returned 5
	[0075.693] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0075.693] lstrlenW (lpString=".icb") returned 4
	[0075.693] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0075.694] lstrlenW (lpString=".ics") returned 4
	[0075.694] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0075.694] lstrlenW (lpString=".iff") returned 4
	[0075.694] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0075.694] lstrlenW (lpString=".inc") returned 4
	[0075.694] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0075.695] lstrlenW (lpString=".indd") returned 5
	[0075.695] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0075.695] lstrlenW (lpString=".ini") returned 4
	[0075.695] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0075.695] lstrlenW (lpString=".iqy") returned 4
	[0075.696] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0075.696] lstrlenW (lpString=".j2c") returned 4
	[0075.696] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0075.696] lstrlenW (lpString=".j2k") returned 4
	[0075.696] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0075.696] lstrlenW (lpString=".java") returned 5
	[0075.697] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0075.697] lstrlenW (lpString=".jp2") returned 4
	[0075.697] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0075.697] lstrlenW (lpString=".jpc") returned 4
	[0075.697] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0075.697] lstrlenW (lpString=".jpe") returned 4
	[0075.698] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0075.698] lstrlenW (lpString=".jpeg") returned 5
	[0075.698] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0075.698] lstrlenW (lpString=".jpf") returned 4
	[0075.698] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0075.698] lstrlenW (lpString=".jpg") returned 4
	[0075.699] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0075.699] lstrlenW (lpString=".jpx") returned 4
	[0075.699] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0075.699] lstrlenW (lpString=".js") returned 3
	[0075.699] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0075.699] lstrlenW (lpString=".jsf") returned 4
	[0075.700] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0075.700] lstrlenW (lpString=".json") returned 5
	[0075.700] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0075.700] lstrlenW (lpString=".jsp") returned 4
	[0075.700] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0075.700] lstrlenW (lpString=".kdc") returned 4
	[0075.700] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0075.701] lstrlenW (lpString=".kmz") returned 4
	[0075.701] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0075.701] lstrlenW (lpString=".kwm") returned 4
	[0075.701] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0075.701] lstrlenW (lpString=".lasso") returned 6
	[0075.701] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0075.702] lstrlenW (lpString=".lbi") returned 4
	[0075.702] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0075.702] lstrlenW (lpString=".lgf") returned 4
	[0075.702] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0075.702] lstrlenW (lpString=".lgp") returned 4
	[0075.702] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0075.703] lstrlenW (lpString=".log") returned 4
	[0075.703] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0075.703] lstrlenW (lpString=".m1v") returned 4
	[0075.703] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0075.703] lstrlenW (lpString=".m4a") returned 4
	[0075.703] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0075.703] lstrlenW (lpString=".m4v") returned 4
	[0075.704] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0075.704] lstrlenW (lpString=".max") returned 4
	[0075.704] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0075.704] lstrlenW (lpString=".md") returned 3
	[0075.704] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0075.704] lstrlenW (lpString=".mda") returned 4
	[0075.705] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0075.705] lstrlenW (lpString=".mdb") returned 4
	[0075.705] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0075.705] lstrlenW (lpString=".mde") returned 4
	[0075.705] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0075.705] lstrlenW (lpString=".mdf") returned 4
	[0075.706] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0075.706] lstrlenW (lpString=".mdw") returned 4
	[0075.706] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0075.706] lstrlenW (lpString=".mef") returned 4
	[0075.706] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0075.706] lstrlenW (lpString=".mft") returned 4
	[0075.707] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0075.707] lstrlenW (lpString=".mfw") returned 4
	[0075.707] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0075.707] lstrlenW (lpString=".mht") returned 4
	[0075.707] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0075.708] lstrlenW (lpString=".mhtml") returned 6
	[0075.708] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0075.708] lstrlenW (lpString=".mka") returned 4
	[0075.708] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0075.708] lstrlenW (lpString=".mkidx") returned 6
	[0075.708] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0075.709] lstrlenW (lpString=".mkv") returned 4
	[0075.709] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0075.709] lstrlenW (lpString=".mos") returned 4
	[0075.709] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0075.709] lstrlenW (lpString=".mov") returned 4
	[0075.709] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0075.710] lstrlenW (lpString=".mp3") returned 4
	[0075.710] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0075.710] lstrlenW (lpString=".mp4") returned 4
	[0075.710] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0075.710] lstrlenW (lpString=".mpeg") returned 5
	[0075.710] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0075.710] lstrlenW (lpString=".mpg") returned 4
	[0075.711] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0075.711] lstrlenW (lpString=".mpv") returned 4
	[0075.711] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0075.711] lstrlenW (lpString=".mrw") returned 4
	[0075.711] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0075.711] lstrlenW (lpString=".msg") returned 4
	[0075.712] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0075.712] lstrlenW (lpString=".mxl") returned 4
	[0075.712] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0075.712] lstrlenW (lpString=".myd") returned 4
	[0075.712] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0075.712] lstrlenW (lpString=".myi") returned 4
	[0075.712] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0075.713] lstrlenW (lpString=".nef") returned 4
	[0075.713] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0075.713] lstrlenW (lpString=".nrw") returned 4
	[0075.713] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0075.713] lstrlenW (lpString=".obj") returned 4
	[0075.713] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0075.713] lstrlenW (lpString=".odb") returned 4
	[0075.714] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0075.714] lstrlenW (lpString=".odc") returned 4
	[0075.714] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0075.714] lstrlenW (lpString=".odm") returned 4
	[0075.714] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0075.714] lstrlenW (lpString=".odp") returned 4
	[0075.715] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0075.715] lstrlenW (lpString=".ods") returned 4
	[0075.715] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0075.715] lstrlenW (lpString=".oft") returned 4
	[0075.715] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0075.715] lstrlenW (lpString=".one") returned 4
	[0075.715] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0075.716] lstrlenW (lpString=".onepkg") returned 7
	[0075.716] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0075.716] lstrlenW (lpString=".onetoc2") returned 8
	[0075.716] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0075.716] lstrlenW (lpString=".opt") returned 4
	[0075.716] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0075.716] lstrlenW (lpString=".oqy") returned 4
	[0075.716] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0075.717] lstrlenW (lpString=".orf") returned 4
	[0075.717] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0075.717] lstrlenW (lpString=".p12") returned 4
	[0075.717] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0075.717] lstrlenW (lpString=".p7b") returned 4
	[0075.717] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0075.717] lstrlenW (lpString=".p7c") returned 4
	[0075.717] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0075.718] lstrlenW (lpString=".pam") returned 4
	[0075.718] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0075.718] lstrlenW (lpString=".pbm") returned 4
	[0075.718] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0075.718] lstrlenW (lpString=".pct") returned 4
	[0075.718] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0075.718] lstrlenW (lpString=".pcx") returned 4
	[0075.719] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0075.719] lstrlenW (lpString=".pdd") returned 4
	[0075.719] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0075.719] lstrlenW (lpString=".pdf") returned 4
	[0075.719] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0075.719] lstrlenW (lpString=".pdp") returned 4
	[0075.720] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0075.720] lstrlenW (lpString=".pef") returned 4
	[0075.720] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0075.720] lstrlenW (lpString=".pem") returned 4
	[0075.720] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0075.720] lstrlenW (lpString=".pff") returned 4
	[0075.721] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0075.721] lstrlenW (lpString=".pfm") returned 4
	[0075.721] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0075.721] lstrlenW (lpString=".pfx") returned 4
	[0075.721] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0075.721] lstrlenW (lpString=".pgm") returned 4
	[0075.722] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0075.722] lstrlenW (lpString=".php") returned 4
	[0075.722] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0075.722] lstrlenW (lpString=".php3") returned 5
	[0075.722] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0075.723] lstrlenW (lpString=".php4") returned 5
	[0075.821] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0075.821] lstrlenW (lpString=".php5") returned 5
	[0075.821] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0075.822] lstrlenW (lpString=".phtml") returned 6
	[0075.822] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0075.822] lstrlenW (lpString=".pict") returned 5
	[0075.822] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0075.822] lstrlenW (lpString=".pl") returned 3
	[0075.822] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0075.822] lstrlenW (lpString=".pls") returned 4
	[0075.823] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0075.823] lstrlenW (lpString=".pm") returned 3
	[0075.823] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0075.823] lstrlenW (lpString=".png") returned 4
	[0075.823] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0075.823] lstrlenW (lpString=".pnm") returned 4
	[0075.824] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0075.824] lstrlenW (lpString=".pot") returned 4
	[0075.824] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0075.824] lstrlenW (lpString=".potm") returned 5
	[0075.824] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0075.824] lstrlenW (lpString=".potx") returned 5
	[0075.825] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0075.825] lstrlenW (lpString=".ppa") returned 4
	[0075.825] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0075.825] lstrlenW (lpString=".ppam") returned 5
	[0075.825] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0075.825] lstrlenW (lpString=".ppm") returned 4
	[0075.826] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0075.826] lstrlenW (lpString=".pps") returned 4
	[0075.826] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0075.826] lstrlenW (lpString=".ppsm") returned 5
	[0075.826] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0075.826] lstrlenW (lpString=".ppt") returned 4
	[0075.826] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0075.827] lstrlenW (lpString=".pptm") returned 5
	[0075.827] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0075.827] lstrlenW (lpString=".pptx") returned 5
	[0075.827] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0075.827] lstrlenW (lpString=".prn") returned 4
	[0075.827] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0075.827] lstrlenW (lpString=".ps") returned 3
	[0075.828] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0075.828] lstrlenW (lpString=".psb") returned 4
	[0075.828] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0075.828] lstrlenW (lpString=".psd") returned 4
	[0075.828] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0075.828] lstrlenW (lpString=".pst") returned 4
	[0075.828] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0075.828] lstrlenW (lpString=".ptx") returned 4
	[0075.828] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0075.829] lstrlenW (lpString=".pub") returned 4
	[0075.829] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0075.829] lstrlenW (lpString=".pwm") returned 4
	[0075.829] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0075.829] lstrlenW (lpString=".pxr") returned 4
	[0075.829] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0075.829] lstrlenW (lpString=".py") returned 3
	[0075.829] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0075.830] lstrlenW (lpString=".qt") returned 3
	[0075.830] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0075.830] lstrlenW (lpString=".r3d") returned 4
	[0075.830] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0075.830] lstrlenW (lpString=".raf") returned 4
	[0075.830] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0075.830] lstrlenW (lpString=".rar") returned 4
	[0075.830] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0075.831] lstrlenW (lpString=".raw") returned 4
	[0075.831] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0075.831] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0075.831] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0075.832] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0075.832] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0075.833] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0075.833] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13
	[0075.833] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0075.834] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.834] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0075.834] lstrlenW (lpString="chs_boot.ttf") returned 12
	[0075.835] lstrlenW (lpString=".1cd") returned 4
	[0075.835] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0075.835] lstrlenW (lpString=".3ds") returned 4
	[0075.835] lstrcmpiW (lpString1=".3ds", lpString2=".ttf") returned -1
	[0075.835] lstrlenW (lpString=".3fr") returned 4
	[0075.836] lstrcmpiW (lpString1=".3fr", lpString2=".ttf") returned -1
	[0075.836] lstrlenW (lpString=".3g2") returned 4
	[0075.836] lstrcmpiW (lpString1=".3g2", lpString2=".ttf") returned -1
	[0075.836] lstrlenW (lpString=".3gp") returned 4
	[0075.836] lstrcmpiW (lpString1=".3gp", lpString2=".ttf") returned -1
	[0075.836] lstrlenW (lpString=".7z") returned 3
	[0075.836] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0075.837] lstrlenW (lpString=".accda") returned 6
	[0075.837] lstrcmpiW (lpString1=".accda", lpString2="ot.ttf") returned -1
	[0075.837] lstrlenW (lpString=".accdb") returned 6
	[0075.837] lstrcmpiW (lpString1=".accdb", lpString2="ot.ttf") returned -1
	[0075.837] lstrlenW (lpString=".accdc") returned 6
	[0075.837] lstrcmpiW (lpString1=".accdc", lpString2="ot.ttf") returned -1
	[0075.837] lstrlenW (lpString=".accde") returned 6
	[0075.838] lstrcmpiW (lpString1=".accde", lpString2="ot.ttf") returned -1
	[0075.838] lstrlenW (lpString=".accdt") returned 6
	[0075.838] lstrcmpiW (lpString1=".accdt", lpString2="ot.ttf") returned -1
	[0075.838] lstrlenW (lpString=".accdw") returned 6
	[0075.838] lstrcmpiW (lpString1=".accdw", lpString2="ot.ttf") returned -1
	[0075.838] lstrlenW (lpString=".adb") returned 4
	[0075.838] lstrcmpiW (lpString1=".adb", lpString2=".ttf") returned -1
	[0075.839] lstrlenW (lpString=".adp") returned 4
	[0075.839] lstrcmpiW (lpString1=".adp", lpString2=".ttf") returned -1
	[0075.839] lstrlenW (lpString=".ai") returned 3
	[0075.839] lstrcmpiW (lpString1=".ai", lpString2="ttf") returned -1
	[0075.839] lstrlenW (lpString=".ai3") returned 4
	[0075.839] lstrcmpiW (lpString1=".ai3", lpString2=".ttf") returned -1
	[0075.840] lstrlenW (lpString=".ai4") returned 4
	[0075.840] lstrcmpiW (lpString1=".ai4", lpString2=".ttf") returned -1
	[0075.840] lstrlenW (lpString=".ai5") returned 4
	[0075.840] lstrcmpiW (lpString1=".ai5", lpString2=".ttf") returned -1
	[0075.840] lstrlenW (lpString=".ai6") returned 4
	[0075.840] lstrcmpiW (lpString1=".ai6", lpString2=".ttf") returned -1
	[0075.840] lstrlenW (lpString=".ai7") returned 4
	[0075.841] lstrcmpiW (lpString1=".ai7", lpString2=".ttf") returned -1
	[0075.841] lstrlenW (lpString=".ai8") returned 4
	[0075.841] lstrcmpiW (lpString1=".ai8", lpString2=".ttf") returned -1
	[0075.841] lstrlenW (lpString=".anim") returned 5
	[0075.841] lstrcmpiW (lpString1=".anim", lpString2="t.ttf") returned -1
	[0075.841] lstrlenW (lpString=".arw") returned 4
	[0075.841] lstrcmpiW (lpString1=".arw", lpString2=".ttf") returned -1
	[0075.842] lstrlenW (lpString=".as") returned 3
	[0075.842] lstrcmpiW (lpString1=".as", lpString2="ttf") returned -1
	[0075.842] lstrlenW (lpString=".asa") returned 4
	[0075.842] lstrcmpiW (lpString1=".asa", lpString2=".ttf") returned -1
	[0075.842] lstrlenW (lpString=".asc") returned 4
	[0075.842] lstrcmpiW (lpString1=".asc", lpString2=".ttf") returned -1
	[0075.843] lstrlenW (lpString=".ascx") returned 5
	[0075.843] lstrcmpiW (lpString1=".ascx", lpString2="t.ttf") returned -1
	[0075.843] lstrlenW (lpString=".asm") returned 4
	[0075.843] lstrcmpiW (lpString1=".asm", lpString2=".ttf") returned -1
	[0075.843] lstrlenW (lpString=".asmx") returned 5
	[0075.843] lstrcmpiW (lpString1=".asmx", lpString2="t.ttf") returned -1
	[0075.844] lstrlenW (lpString=".asp") returned 4
	[0075.844] lstrcmpiW (lpString1=".asp", lpString2=".ttf") returned -1
	[0075.844] lstrlenW (lpString=".aspx") returned 5
	[0075.844] lstrcmpiW (lpString1=".aspx", lpString2="t.ttf") returned -1
	[0075.844] lstrlenW (lpString=".asr") returned 4
	[0075.844] lstrcmpiW (lpString1=".asr", lpString2=".ttf") returned -1
	[0075.845] lstrlenW (lpString=".asx") returned 4
	[0075.845] lstrcmpiW (lpString1=".asx", lpString2=".ttf") returned -1
	[0075.845] lstrlenW (lpString=".avi") returned 4
	[0075.845] lstrcmpiW (lpString1=".avi", lpString2=".ttf") returned -1
	[0075.845] lstrlenW (lpString=".avs") returned 4
	[0075.845] lstrcmpiW (lpString1=".avs", lpString2=".ttf") returned -1
	[0075.846] lstrlenW (lpString=".backup") returned 7
	[0075.846] lstrcmpiW (lpString1=".backup", lpString2="oot.ttf") returned -1
	[0075.846] lstrlenW (lpString=".bak") returned 4
	[0075.846] lstrcmpiW (lpString1=".bak", lpString2=".ttf") returned -1
	[0075.846] lstrlenW (lpString=".bay") returned 4
	[0075.846] lstrcmpiW (lpString1=".bay", lpString2=".ttf") returned -1
	[0075.847] lstrlenW (lpString=".bd") returned 3
	[0075.847] lstrcmpiW (lpString1=".bd", lpString2="ttf") returned -1
	[0075.847] lstrlenW (lpString=".bin") returned 4
	[0075.847] lstrcmpiW (lpString1=".bin", lpString2=".ttf") returned -1
	[0075.847] lstrlenW (lpString=".bmp") returned 4
	[0075.847] lstrcmpiW (lpString1=".bmp", lpString2=".ttf") returned -1
	[0075.848] lstrlenW (lpString=".bz2") returned 4
	[0075.848] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0075.848] lstrlenW (lpString=".c") returned 2
	[0075.848] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0075.848] lstrlenW (lpString=".cdr") returned 4
	[0075.848] lstrcmpiW (lpString1=".cdr", lpString2=".ttf") returned -1
	[0075.849] lstrlenW (lpString=".cer") returned 4
	[0075.849] lstrcmpiW (lpString1=".cer", lpString2=".ttf") returned -1
	[0075.849] lstrlenW (lpString=".cf") returned 3
	[0075.849] lstrcmpiW (lpString1=".cf", lpString2="ttf") returned -1
	[0075.849] lstrlenW (lpString=".cfc") returned 4
	[0075.850] lstrcmpiW (lpString1=".cfc", lpString2=".ttf") returned -1
	[0075.850] lstrlenW (lpString=".cfm") returned 4
	[0075.850] lstrcmpiW (lpString1=".cfm", lpString2=".ttf") returned -1
	[0075.850] lstrlenW (lpString=".cfml") returned 5
	[0075.850] lstrcmpiW (lpString1=".cfml", lpString2="t.ttf") returned -1
	[0075.850] lstrlenW (lpString=".cfu") returned 4
	[0075.850] lstrcmpiW (lpString1=".cfu", lpString2=".ttf") returned -1
	[0075.851] lstrlenW (lpString=".chm") returned 4
	[0075.851] lstrcmpiW (lpString1=".chm", lpString2=".ttf") returned -1
	[0075.851] lstrlenW (lpString=".cin") returned 4
	[0075.851] lstrcmpiW (lpString1=".cin", lpString2=".ttf") returned -1
	[0075.851] lstrlenW (lpString=".class") returned 6
	[0075.852] lstrcmpiW (lpString1=".class", lpString2="ot.ttf") returned -1
	[0075.852] lstrlenW (lpString=".clx") returned 4
	[0075.852] lstrcmpiW (lpString1=".clx", lpString2=".ttf") returned -1
	[0075.852] lstrlenW (lpString=".config") returned 7
	[0075.852] lstrcmpiW (lpString1=".config", lpString2="oot.ttf") returned -1
	[0075.852] lstrlenW (lpString=".cpp") returned 4
	[0075.852] lstrcmpiW (lpString1=".cpp", lpString2=".ttf") returned -1
	[0075.853] lstrlenW (lpString=".cr2") returned 4
	[0075.853] lstrcmpiW (lpString1=".cr2", lpString2=".ttf") returned -1
	[0075.853] lstrlenW (lpString=".crt") returned 4
	[0075.853] lstrcmpiW (lpString1=".crt", lpString2=".ttf") returned -1
	[0075.853] lstrlenW (lpString=".crw") returned 4
	[0075.853] lstrcmpiW (lpString1=".crw", lpString2=".ttf") returned -1
	[0075.854] lstrlenW (lpString=".cs") returned 3
	[0075.854] lstrcmpiW (lpString1=".cs", lpString2="ttf") returned -1
	[0075.854] lstrlenW (lpString=".css") returned 4
	[0075.854] lstrcmpiW (lpString1=".css", lpString2=".ttf") returned -1
	[0075.854] lstrlenW (lpString=".csv") returned 4
	[0075.854] lstrcmpiW (lpString1=".csv", lpString2=".ttf") returned -1
	[0075.854] lstrlenW (lpString=".cub") returned 4
	[0075.855] lstrcmpiW (lpString1=".cub", lpString2=".ttf") returned -1
	[0075.855] lstrlenW (lpString=".dae") returned 4
	[0075.855] lstrcmpiW (lpString1=".dae", lpString2=".ttf") returned -1
	[0075.855] lstrlenW (lpString=".dat") returned 4
	[0075.855] lstrcmpiW (lpString1=".dat", lpString2=".ttf") returned -1
	[0075.855] lstrlenW (lpString=".db") returned 3
	[0075.855] lstrcmpiW (lpString1=".db", lpString2="ttf") returned -1
	[0075.856] lstrlenW (lpString=".dbf") returned 4
	[0075.856] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0075.856] lstrlenW (lpString=".dbx") returned 4
	[0075.856] lstrcmpiW (lpString1=".dbx", lpString2=".ttf") returned -1
	[0075.856] lstrlenW (lpString=".dc3") returned 4
	[0075.856] lstrcmpiW (lpString1=".dc3", lpString2=".ttf") returned -1
	[0075.856] lstrlenW (lpString=".dcm") returned 4
	[0075.857] lstrcmpiW (lpString1=".dcm", lpString2=".ttf") returned -1
	[0075.857] lstrlenW (lpString=".dcr") returned 4
	[0075.857] lstrcmpiW (lpString1=".dcr", lpString2=".ttf") returned -1
	[0075.857] lstrlenW (lpString=".der") returned 4
	[0075.857] lstrcmpiW (lpString1=".der", lpString2=".ttf") returned -1
	[0075.857] lstrlenW (lpString=".dib") returned 4
	[0075.858] lstrcmpiW (lpString1=".dib", lpString2=".ttf") returned -1
	[0075.858] lstrlenW (lpString=".dic") returned 4
	[0075.858] lstrcmpiW (lpString1=".dic", lpString2=".ttf") returned -1
	[0075.858] lstrlenW (lpString=".dif") returned 4
	[0075.858] lstrcmpiW (lpString1=".dif", lpString2=".ttf") returned -1
	[0075.858] lstrlenW (lpString=".divx") returned 5
	[0075.859] lstrcmpiW (lpString1=".divx", lpString2="t.ttf") returned -1
	[0075.859] lstrlenW (lpString=".djvu") returned 5
	[0075.859] lstrcmpiW (lpString1=".djvu", lpString2="t.ttf") returned -1
	[0075.859] lstrlenW (lpString=".dng") returned 4
	[0075.859] lstrcmpiW (lpString1=".dng", lpString2=".ttf") returned -1
	[0075.859] lstrlenW (lpString=".doc") returned 4
	[0075.860] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0075.860] lstrlenW (lpString=".docm") returned 5
	[0075.860] lstrcmpiW (lpString1=".docm", lpString2="t.ttf") returned -1
	[0075.860] lstrlenW (lpString=".docx") returned 5
	[0075.860] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0075.860] lstrlenW (lpString=".dot") returned 4
	[0075.860] lstrcmpiW (lpString1=".dot", lpString2=".ttf") returned -1
	[0075.861] lstrlenW (lpString=".dotm") returned 5
	[0075.861] lstrcmpiW (lpString1=".dotm", lpString2="t.ttf") returned -1
	[0075.861] lstrlenW (lpString=".dotx") returned 5
	[0075.861] lstrcmpiW (lpString1=".dotx", lpString2="t.ttf") returned -1
	[0075.861] lstrlenW (lpString=".dpx") returned 4
	[0075.861] lstrcmpiW (lpString1=".dpx", lpString2=".ttf") returned -1
	[0075.862] lstrlenW (lpString=".dqy") returned 4
	[0075.862] lstrcmpiW (lpString1=".dqy", lpString2=".ttf") returned -1
	[0075.862] lstrlenW (lpString=".dsn") returned 4
	[0075.862] lstrcmpiW (lpString1=".dsn", lpString2=".ttf") returned -1
	[0075.862] lstrlenW (lpString=".dt") returned 3
	[0075.862] lstrcmpiW (lpString1=".dt", lpString2="ttf") returned -1
	[0075.862] lstrlenW (lpString=".dtd") returned 4
	[0075.863] lstrcmpiW (lpString1=".dtd", lpString2=".ttf") returned -1
	[0075.863] lstrlenW (lpString=".dwg") returned 4
	[0075.863] lstrcmpiW (lpString1=".dwg", lpString2=".ttf") returned -1
	[0076.020] lstrlenW (lpString=".dwt") returned 4
	[0076.020] lstrcmpiW (lpString1=".dwt", lpString2=".ttf") returned -1
	[0076.021] lstrlenW (lpString=".dx") returned 3
	[0076.021] lstrcmpiW (lpString1=".dx", lpString2="ttf") returned -1
	[0076.021] lstrlenW (lpString=".dxf") returned 4
	[0076.021] lstrcmpiW (lpString1=".dxf", lpString2=".ttf") returned -1
	[0076.021] lstrlenW (lpString=".edml") returned 5
	[0076.021] lstrcmpiW (lpString1=".edml", lpString2="t.ttf") returned -1
	[0076.022] lstrlenW (lpString=".efd") returned 4
	[0076.022] lstrcmpiW (lpString1=".efd", lpString2=".ttf") returned -1
	[0076.022] lstrlenW (lpString=".elf") returned 4
	[0076.022] lstrcmpiW (lpString1=".elf", lpString2=".ttf") returned -1
	[0076.022] lstrlenW (lpString=".emf") returned 4
	[0076.023] lstrcmpiW (lpString1=".emf", lpString2=".ttf") returned -1
	[0076.023] lstrlenW (lpString=".emz") returned 4
	[0076.023] lstrcmpiW (lpString1=".emz", lpString2=".ttf") returned -1
	[0076.023] lstrlenW (lpString=".epf") returned 4
	[0076.023] lstrcmpiW (lpString1=".epf", lpString2=".ttf") returned -1
	[0076.023] lstrlenW (lpString=".eps") returned 4
	[0076.024] lstrcmpiW (lpString1=".eps", lpString2=".ttf") returned -1
	[0076.024] lstrlenW (lpString=".epsf") returned 5
	[0076.024] lstrcmpiW (lpString1=".epsf", lpString2="t.ttf") returned -1
	[0076.024] lstrlenW (lpString=".epsp") returned 5
	[0076.024] lstrcmpiW (lpString1=".epsp", lpString2="t.ttf") returned -1
	[0076.025] lstrlenW (lpString=".erf") returned 4
	[0076.025] lstrcmpiW (lpString1=".erf", lpString2=".ttf") returned -1
	[0076.025] lstrlenW (lpString=".exr") returned 4
	[0076.025] lstrcmpiW (lpString1=".exr", lpString2=".ttf") returned -1
	[0076.025] lstrlenW (lpString=".f4v") returned 4
	[0076.025] lstrcmpiW (lpString1=".f4v", lpString2=".ttf") returned -1
	[0076.026] lstrlenW (lpString=".fido") returned 5
	[0076.026] lstrcmpiW (lpString1=".fido", lpString2="t.ttf") returned -1
	[0076.026] lstrlenW (lpString=".flm") returned 4
	[0076.026] lstrcmpiW (lpString1=".flm", lpString2=".ttf") returned -1
	[0076.026] lstrlenW (lpString=".flv") returned 4
	[0076.027] lstrcmpiW (lpString1=".flv", lpString2=".ttf") returned -1
	[0076.027] lstrlenW (lpString=".frm") returned 4
	[0076.027] lstrcmpiW (lpString1=".frm", lpString2=".ttf") returned -1
	[0076.027] lstrlenW (lpString=".fxg") returned 4
	[0076.027] lstrcmpiW (lpString1=".fxg", lpString2=".ttf") returned -1
	[0076.027] lstrlenW (lpString=".geo") returned 4
	[0076.028] lstrcmpiW (lpString1=".geo", lpString2=".ttf") returned -1
	[0076.028] lstrlenW (lpString=".gif") returned 4
	[0076.028] lstrcmpiW (lpString1=".gif", lpString2=".ttf") returned -1
	[0076.028] lstrlenW (lpString=".grs") returned 4
	[0076.028] lstrcmpiW (lpString1=".grs", lpString2=".ttf") returned -1
	[0076.028] lstrlenW (lpString=".gz") returned 3
	[0076.029] lstrcmpiW (lpString1=".gz", lpString2="ttf") returned -1
	[0076.029] lstrlenW (lpString=".h") returned 2
	[0076.029] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0076.029] lstrlenW (lpString=".hdr") returned 4
	[0076.029] lstrcmpiW (lpString1=".hdr", lpString2=".ttf") returned -1
	[0076.029] lstrlenW (lpString=".hpp") returned 4
	[0076.030] lstrcmpiW (lpString1=".hpp", lpString2=".ttf") returned -1
	[0076.030] lstrlenW (lpString=".hta") returned 4
	[0076.030] lstrcmpiW (lpString1=".hta", lpString2=".ttf") returned -1
	[0076.030] lstrlenW (lpString=".htc") returned 4
	[0076.030] lstrcmpiW (lpString1=".htc", lpString2=".ttf") returned -1
	[0076.030] lstrlenW (lpString=".htm") returned 4
	[0076.031] lstrcmpiW (lpString1=".htm", lpString2=".ttf") returned -1
	[0076.031] lstrlenW (lpString=".html") returned 5
	[0076.031] lstrcmpiW (lpString1=".html", lpString2="t.ttf") returned -1
	[0076.031] lstrlenW (lpString=".icb") returned 4
	[0076.031] lstrcmpiW (lpString1=".icb", lpString2=".ttf") returned -1
	[0076.031] lstrlenW (lpString=".ics") returned 4
	[0076.032] lstrcmpiW (lpString1=".ics", lpString2=".ttf") returned -1
	[0076.032] lstrlenW (lpString=".iff") returned 4
	[0076.032] lstrcmpiW (lpString1=".iff", lpString2=".ttf") returned -1
	[0076.032] lstrlenW (lpString=".inc") returned 4
	[0076.032] lstrcmpiW (lpString1=".inc", lpString2=".ttf") returned -1
	[0076.032] lstrlenW (lpString=".indd") returned 5
	[0076.033] lstrcmpiW (lpString1=".indd", lpString2="t.ttf") returned -1
	[0076.033] lstrlenW (lpString=".ini") returned 4
	[0076.033] lstrcmpiW (lpString1=".ini", lpString2=".ttf") returned -1
	[0076.033] lstrlenW (lpString=".iqy") returned 4
	[0076.033] lstrcmpiW (lpString1=".iqy", lpString2=".ttf") returned -1
	[0076.033] lstrlenW (lpString=".j2c") returned 4
	[0076.034] lstrcmpiW (lpString1=".j2c", lpString2=".ttf") returned -1
	[0076.034] lstrlenW (lpString=".j2k") returned 4
	[0076.034] lstrcmpiW (lpString1=".j2k", lpString2=".ttf") returned -1
	[0076.034] lstrlenW (lpString=".java") returned 5
	[0076.034] lstrcmpiW (lpString1=".java", lpString2="t.ttf") returned -1
	[0076.034] lstrlenW (lpString=".jp2") returned 4
	[0076.035] lstrcmpiW (lpString1=".jp2", lpString2=".ttf") returned -1
	[0076.035] lstrlenW (lpString=".jpc") returned 4
	[0076.035] lstrcmpiW (lpString1=".jpc", lpString2=".ttf") returned -1
	[0076.036] lstrlenW (lpString=".jpe") returned 4
	[0076.036] lstrcmpiW (lpString1=".jpe", lpString2=".ttf") returned -1
	[0076.036] lstrlenW (lpString=".jpeg") returned 5
	[0076.036] lstrcmpiW (lpString1=".jpeg", lpString2="t.ttf") returned -1
	[0076.036] lstrlenW (lpString=".jpf") returned 4
	[0076.037] lstrcmpiW (lpString1=".jpf", lpString2=".ttf") returned -1
	[0076.037] lstrlenW (lpString=".jpg") returned 4
	[0076.037] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0076.037] lstrlenW (lpString=".jpx") returned 4
	[0076.037] lstrcmpiW (lpString1=".jpx", lpString2=".ttf") returned -1
	[0076.037] lstrlenW (lpString=".js") returned 3
	[0076.038] lstrcmpiW (lpString1=".js", lpString2="ttf") returned -1
	[0076.038] lstrlenW (lpString=".jsf") returned 4
	[0076.038] lstrcmpiW (lpString1=".jsf", lpString2=".ttf") returned -1
	[0076.038] lstrlenW (lpString=".json") returned 5
	[0076.038] lstrcmpiW (lpString1=".json", lpString2="t.ttf") returned -1
	[0076.039] lstrlenW (lpString=".jsp") returned 4
	[0076.039] lstrcmpiW (lpString1=".jsp", lpString2=".ttf") returned -1
	[0076.039] lstrlenW (lpString=".kdc") returned 4
	[0076.042] lstrcmpiW (lpString1=".kdc", lpString2=".ttf") returned -1
	[0076.042] lstrlenW (lpString=".kmz") returned 4
	[0076.042] lstrcmpiW (lpString1=".kmz", lpString2=".ttf") returned -1
	[0076.042] lstrlenW (lpString=".kwm") returned 4
	[0076.043] lstrcmpiW (lpString1=".kwm", lpString2=".ttf") returned -1
	[0076.043] lstrlenW (lpString=".lasso") returned 6
	[0076.043] lstrcmpiW (lpString1=".lasso", lpString2="ot.ttf") returned -1
	[0076.043] lstrlenW (lpString=".lbi") returned 4
	[0076.043] lstrcmpiW (lpString1=".lbi", lpString2=".ttf") returned -1
	[0076.043] lstrlenW (lpString=".lgf") returned 4
	[0076.044] lstrcmpiW (lpString1=".lgf", lpString2=".ttf") returned -1
	[0076.044] lstrlenW (lpString=".lgp") returned 4
	[0076.044] lstrcmpiW (lpString1=".lgp", lpString2=".ttf") returned -1
	[0076.044] lstrlenW (lpString=".log") returned 4
	[0076.044] lstrcmpiW (lpString1=".log", lpString2=".ttf") returned -1
	[0076.044] lstrlenW (lpString=".m1v") returned 4
	[0076.045] lstrcmpiW (lpString1=".m1v", lpString2=".ttf") returned -1
	[0076.045] lstrlenW (lpString=".m4a") returned 4
	[0076.045] lstrcmpiW (lpString1=".m4a", lpString2=".ttf") returned -1
	[0076.045] lstrlenW (lpString=".m4v") returned 4
	[0076.045] lstrcmpiW (lpString1=".m4v", lpString2=".ttf") returned -1
	[0076.045] lstrlenW (lpString=".max") returned 4
	[0076.045] lstrcmpiW (lpString1=".max", lpString2=".ttf") returned -1
	[0076.046] lstrlenW (lpString=".md") returned 3
	[0076.046] lstrcmpiW (lpString1=".md", lpString2="ttf") returned -1
	[0076.046] lstrlenW (lpString=".mda") returned 4
	[0076.046] lstrcmpiW (lpString1=".mda", lpString2=".ttf") returned -1
	[0076.046] lstrlenW (lpString=".mdb") returned 4
	[0076.046] lstrcmpiW (lpString1=".mdb", lpString2=".ttf") returned -1
	[0076.046] lstrlenW (lpString=".mde") returned 4
	[0076.047] lstrcmpiW (lpString1=".mde", lpString2=".ttf") returned -1
	[0076.047] lstrlenW (lpString=".mdf") returned 4
	[0076.047] lstrcmpiW (lpString1=".mdf", lpString2=".ttf") returned -1
	[0076.047] lstrlenW (lpString=".mdw") returned 4
	[0076.047] lstrcmpiW (lpString1=".mdw", lpString2=".ttf") returned -1
	[0076.047] lstrlenW (lpString=".mef") returned 4
	[0076.047] lstrcmpiW (lpString1=".mef", lpString2=".ttf") returned -1
	[0076.048] lstrlenW (lpString=".mft") returned 4
	[0076.048] lstrcmpiW (lpString1=".mft", lpString2=".ttf") returned -1
	[0076.048] lstrlenW (lpString=".mfw") returned 4
	[0076.048] lstrcmpiW (lpString1=".mfw", lpString2=".ttf") returned -1
	[0076.048] lstrlenW (lpString=".mht") returned 4
	[0076.048] lstrcmpiW (lpString1=".mht", lpString2=".ttf") returned -1
	[0076.049] lstrlenW (lpString=".mhtml") returned 6
	[0076.049] lstrcmpiW (lpString1=".mhtml", lpString2="ot.ttf") returned -1
	[0076.049] lstrlenW (lpString=".mka") returned 4
	[0076.049] lstrcmpiW (lpString1=".mka", lpString2=".ttf") returned -1
	[0076.049] lstrlenW (lpString=".mkidx") returned 6
	[0076.049] lstrcmpiW (lpString1=".mkidx", lpString2="ot.ttf") returned -1
	[0076.050] lstrlenW (lpString=".mkv") returned 4
	[0076.050] lstrcmpiW (lpString1=".mkv", lpString2=".ttf") returned -1
	[0076.050] lstrlenW (lpString=".mos") returned 4
	[0076.050] lstrcmpiW (lpString1=".mos", lpString2=".ttf") returned -1
	[0076.050] lstrlenW (lpString=".mov") returned 4
	[0076.050] lstrcmpiW (lpString1=".mov", lpString2=".ttf") returned -1
	[0076.051] lstrlenW (lpString=".mp3") returned 4
	[0076.051] lstrcmpiW (lpString1=".mp3", lpString2=".ttf") returned -1
	[0076.051] lstrlenW (lpString=".mp4") returned 4
	[0076.051] lstrcmpiW (lpString1=".mp4", lpString2=".ttf") returned -1
	[0076.051] lstrlenW (lpString=".mpeg") returned 5
	[0076.051] lstrcmpiW (lpString1=".mpeg", lpString2="t.ttf") returned -1
	[0076.052] lstrlenW (lpString=".mpg") returned 4
	[0076.052] lstrcmpiW (lpString1=".mpg", lpString2=".ttf") returned -1
	[0076.052] lstrlenW (lpString=".mpv") returned 4
	[0076.052] lstrcmpiW (lpString1=".mpv", lpString2=".ttf") returned -1
	[0076.052] lstrlenW (lpString=".mrw") returned 4
	[0076.052] lstrcmpiW (lpString1=".mrw", lpString2=".ttf") returned -1
	[0076.053] lstrlenW (lpString=".msg") returned 4
	[0076.053] lstrcmpiW (lpString1=".msg", lpString2=".ttf") returned -1
	[0076.053] lstrlenW (lpString=".mxl") returned 4
	[0076.053] lstrcmpiW (lpString1=".mxl", lpString2=".ttf") returned -1
	[0076.053] lstrlenW (lpString=".myd") returned 4
	[0076.053] lstrcmpiW (lpString1=".myd", lpString2=".ttf") returned -1
	[0076.054] lstrlenW (lpString=".myi") returned 4
	[0076.054] lstrcmpiW (lpString1=".myi", lpString2=".ttf") returned -1
	[0076.054] lstrlenW (lpString=".nef") returned 4
	[0076.054] lstrcmpiW (lpString1=".nef", lpString2=".ttf") returned -1
	[0076.054] lstrlenW (lpString=".nrw") returned 4
	[0076.054] lstrcmpiW (lpString1=".nrw", lpString2=".ttf") returned -1
	[0076.055] lstrlenW (lpString=".obj") returned 4
	[0076.055] lstrcmpiW (lpString1=".obj", lpString2=".ttf") returned -1
	[0076.055] lstrlenW (lpString=".odb") returned 4
	[0076.055] lstrcmpiW (lpString1=".odb", lpString2=".ttf") returned -1
	[0076.055] lstrlenW (lpString=".odc") returned 4
	[0076.055] lstrcmpiW (lpString1=".odc", lpString2=".ttf") returned -1
	[0076.055] lstrlenW (lpString=".odm") returned 4
	[0076.056] lstrcmpiW (lpString1=".odm", lpString2=".ttf") returned -1
	[0076.056] lstrlenW (lpString=".odp") returned 4
	[0076.056] lstrcmpiW (lpString1=".odp", lpString2=".ttf") returned -1
	[0076.056] lstrlenW (lpString=".ods") returned 4
	[0076.056] lstrcmpiW (lpString1=".ods", lpString2=".ttf") returned -1
	[0076.056] lstrlenW (lpString=".oft") returned 4
	[0076.056] lstrcmpiW (lpString1=".oft", lpString2=".ttf") returned -1
	[0076.057] lstrlenW (lpString=".one") returned 4
	[0076.057] lstrcmpiW (lpString1=".one", lpString2=".ttf") returned -1
	[0076.057] lstrlenW (lpString=".onepkg") returned 7
	[0076.057] lstrcmpiW (lpString1=".onepkg", lpString2="oot.ttf") returned -1
	[0076.057] lstrlenW (lpString=".onetoc2") returned 8
	[0076.057] lstrcmpiW (lpString1=".onetoc2", lpString2="boot.ttf") returned -1
	[0076.057] lstrlenW (lpString=".opt") returned 4
	[0076.058] lstrcmpiW (lpString1=".opt", lpString2=".ttf") returned -1
	[0076.058] lstrlenW (lpString=".oqy") returned 4
	[0076.058] lstrcmpiW (lpString1=".oqy", lpString2=".ttf") returned -1
	[0076.058] lstrlenW (lpString=".orf") returned 4
	[0076.058] lstrcmpiW (lpString1=".orf", lpString2=".ttf") returned -1
	[0076.058] lstrlenW (lpString=".p12") returned 4
	[0076.058] lstrcmpiW (lpString1=".p12", lpString2=".ttf") returned -1
	[0076.058] lstrlenW (lpString=".p7b") returned 4
	[0076.059] lstrcmpiW (lpString1=".p7b", lpString2=".ttf") returned -1
	[0076.059] lstrlenW (lpString=".p7c") returned 4
	[0076.059] lstrcmpiW (lpString1=".p7c", lpString2=".ttf") returned -1
	[0076.059] lstrlenW (lpString=".pam") returned 4
	[0076.059] lstrcmpiW (lpString1=".pam", lpString2=".ttf") returned -1
	[0076.059] lstrlenW (lpString=".pbm") returned 4
	[0076.059] lstrcmpiW (lpString1=".pbm", lpString2=".ttf") returned -1
	[0076.060] lstrlenW (lpString=".pct") returned 4
	[0076.060] lstrcmpiW (lpString1=".pct", lpString2=".ttf") returned -1
	[0076.060] lstrlenW (lpString=".pcx") returned 4
	[0076.060] lstrcmpiW (lpString1=".pcx", lpString2=".ttf") returned -1
	[0076.060] lstrlenW (lpString=".pdd") returned 4
	[0076.060] lstrcmpiW (lpString1=".pdd", lpString2=".ttf") returned -1
	[0076.060] lstrlenW (lpString=".pdf") returned 4
	[0076.060] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0076.061] lstrlenW (lpString=".pdp") returned 4
	[0076.061] lstrcmpiW (lpString1=".pdp", lpString2=".ttf") returned -1
	[0076.061] lstrlenW (lpString=".pef") returned 4
	[0076.061] lstrcmpiW (lpString1=".pef", lpString2=".ttf") returned -1
	[0076.061] lstrlenW (lpString=".pem") returned 4
	[0076.061] lstrcmpiW (lpString1=".pem", lpString2=".ttf") returned -1
	[0076.061] lstrlenW (lpString=".pff") returned 4
	[0076.061] lstrcmpiW (lpString1=".pff", lpString2=".ttf") returned -1
	[0076.062] lstrlenW (lpString=".pfm") returned 4
	[0076.062] lstrcmpiW (lpString1=".pfm", lpString2=".ttf") returned -1
	[0076.062] lstrlenW (lpString=".pfx") returned 4
	[0076.062] lstrcmpiW (lpString1=".pfx", lpString2=".ttf") returned -1
	[0076.062] lstrlenW (lpString=".pgm") returned 4
	[0076.062] lstrcmpiW (lpString1=".pgm", lpString2=".ttf") returned -1
	[0076.062] lstrlenW (lpString=".php") returned 4
	[0076.062] lstrcmpiW (lpString1=".php", lpString2=".ttf") returned -1
	[0076.063] lstrlenW (lpString=".php3") returned 5
	[0076.063] lstrcmpiW (lpString1=".php3", lpString2="t.ttf") returned -1
	[0076.063] lstrlenW (lpString=".php4") returned 5
	[0076.063] lstrcmpiW (lpString1=".php4", lpString2="t.ttf") returned -1
	[0076.063] lstrlenW (lpString=".php5") returned 5
	[0076.063] lstrcmpiW (lpString1=".php5", lpString2="t.ttf") returned -1
	[0076.063] lstrlenW (lpString=".phtml") returned 6
	[0076.064] lstrcmpiW (lpString1=".phtml", lpString2="ot.ttf") returned -1
	[0076.064] lstrlenW (lpString=".pict") returned 5
	[0076.064] lstrcmpiW (lpString1=".pict", lpString2="t.ttf") returned -1
	[0076.064] lstrlenW (lpString=".pl") returned 3
	[0076.064] lstrcmpiW (lpString1=".pl", lpString2="ttf") returned -1
	[0076.064] lstrlenW (lpString=".pls") returned 4
	[0076.064] lstrcmpiW (lpString1=".pls", lpString2=".ttf") returned -1
	[0076.064] lstrlenW (lpString=".pm") returned 3
	[0076.065] lstrcmpiW (lpString1=".pm", lpString2="ttf") returned -1
	[0076.065] lstrlenW (lpString=".png") returned 4
	[0076.065] lstrcmpiW (lpString1=".png", lpString2=".ttf") returned -1
	[0076.065] lstrlenW (lpString=".pnm") returned 4
	[0076.065] lstrcmpiW (lpString1=".pnm", lpString2=".ttf") returned -1
	[0076.065] lstrlenW (lpString=".pot") returned 4
	[0076.065] lstrcmpiW (lpString1=".pot", lpString2=".ttf") returned -1
	[0076.066] lstrlenW (lpString=".potm") returned 5
	[0076.066] lstrcmpiW (lpString1=".potm", lpString2="t.ttf") returned -1
	[0076.445] lstrlenW (lpString=".potx") returned 5
	[0076.445] lstrcmpiW (lpString1=".potx", lpString2="t.ttf") returned -1
	[0076.445] lstrlenW (lpString=".ppa") returned 4
	[0076.445] lstrcmpiW (lpString1=".ppa", lpString2=".ttf") returned -1
	[0076.445] lstrlenW (lpString=".ppam") returned 5
	[0076.445] lstrcmpiW (lpString1=".ppam", lpString2="t.ttf") returned -1
	[0076.446] lstrlenW (lpString=".ppm") returned 4
	[0076.446] lstrcmpiW (lpString1=".ppm", lpString2=".ttf") returned -1
	[0076.446] lstrlenW (lpString=".pps") returned 4
	[0076.446] lstrcmpiW (lpString1=".pps", lpString2=".ttf") returned -1
	[0076.446] lstrlenW (lpString=".ppsm") returned 5
	[0076.446] lstrcmpiW (lpString1=".ppsm", lpString2="t.ttf") returned -1
	[0076.446] lstrlenW (lpString=".ppt") returned 4
	[0076.447] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0076.447] lstrlenW (lpString=".pptm") returned 5
	[0076.447] lstrcmpiW (lpString1=".pptm", lpString2="t.ttf") returned -1
	[0076.447] lstrlenW (lpString=".pptx") returned 5
	[0076.447] lstrcmpiW (lpString1=".pptx", lpString2="t.ttf") returned -1
	[0076.447] lstrlenW (lpString=".prn") returned 4
	[0076.448] lstrcmpiW (lpString1=".prn", lpString2=".ttf") returned -1
	[0076.448] lstrlenW (lpString=".ps") returned 3
	[0076.448] lstrcmpiW (lpString1=".ps", lpString2="ttf") returned -1
	[0076.448] lstrlenW (lpString=".psb") returned 4
	[0076.448] lstrcmpiW (lpString1=".psb", lpString2=".ttf") returned -1
	[0076.448] lstrlenW (lpString=".psd") returned 4
	[0076.449] lstrcmpiW (lpString1=".psd", lpString2=".ttf") returned -1
	[0076.449] lstrlenW (lpString=".pst") returned 4
	[0076.449] lstrcmpiW (lpString1=".pst", lpString2=".ttf") returned -1
	[0076.449] lstrlenW (lpString=".ptx") returned 4
	[0076.449] lstrcmpiW (lpString1=".ptx", lpString2=".ttf") returned -1
	[0076.449] lstrlenW (lpString=".pub") returned 4
	[0076.449] lstrcmpiW (lpString1=".pub", lpString2=".ttf") returned -1
	[0076.450] lstrlenW (lpString=".pwm") returned 4
	[0076.450] lstrcmpiW (lpString1=".pwm", lpString2=".ttf") returned -1
	[0076.450] lstrlenW (lpString=".pxr") returned 4
	[0076.450] lstrcmpiW (lpString1=".pxr", lpString2=".ttf") returned -1
	[0076.450] lstrlenW (lpString=".py") returned 3
	[0076.450] lstrcmpiW (lpString1=".py", lpString2="ttf") returned -1
	[0076.450] lstrlenW (lpString=".qt") returned 3
	[0076.450] lstrcmpiW (lpString1=".qt", lpString2="ttf") returned -1
	[0076.451] lstrlenW (lpString=".r3d") returned 4
	[0076.451] lstrcmpiW (lpString1=".r3d", lpString2=".ttf") returned -1
	[0076.451] lstrlenW (lpString=".raf") returned 4
	[0076.451] lstrcmpiW (lpString1=".raf", lpString2=".ttf") returned -1
	[0076.451] lstrlenW (lpString=".rar") returned 4
	[0076.451] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0076.452] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.452] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.452] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0076.453] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.453] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.453] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.453] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.454] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.454] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.454] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0076.455] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.455] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.455] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.455] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.456] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.456] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.456] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0076.457] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.457] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.457] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.457] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.458] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.458] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.458] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0076.459] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.459] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.459] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.459] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.460] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.460] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.460] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0076.461] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.461] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.461] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.462] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.462] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.462] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.462] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0076.463] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.463] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.463] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.464] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.464] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.464] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.465] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0076.465] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.465] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.466] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.466] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.466] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.467] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.467] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0076.467] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.467] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.468] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.468] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.468] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.469] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.469] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0076.469] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.469] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.515] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.515] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.516] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.517] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.517] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0076.517] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.517] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.519] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.519] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.519] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0076.520] lstrlenW (lpString=".1cd") returned 4
	[0076.520] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0076.520] lstrlenW (lpString=".3ds") returned 4
	[0076.520] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0076.520] lstrlenW (lpString=".3fr") returned 4
	[0076.520] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0076.521] lstrlenW (lpString=".3g2") returned 4
	[0076.521] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0076.521] lstrlenW (lpString=".3gp") returned 4
	[0076.521] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0076.521] lstrlenW (lpString=".7z") returned 3
	[0076.521] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0076.522] lstrlenW (lpString=".accda") returned 6
	[0076.522] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0076.522] lstrlenW (lpString=".accdb") returned 6
	[0076.522] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0076.522] lstrlenW (lpString=".accdc") returned 6
	[0076.522] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0076.523] lstrlenW (lpString=".accde") returned 6
	[0076.523] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0076.523] lstrlenW (lpString=".accdt") returned 6
	[0076.523] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0076.523] lstrlenW (lpString=".accdw") returned 6
	[0076.524] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0076.524] lstrlenW (lpString=".adb") returned 4
	[0076.524] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0076.524] lstrlenW (lpString=".adp") returned 4
	[0076.524] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0076.524] lstrlenW (lpString=".ai") returned 3
	[0076.525] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0076.525] lstrlenW (lpString=".ai3") returned 4
	[0076.525] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0076.525] lstrlenW (lpString=".ai4") returned 4
	[0076.525] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0076.525] lstrlenW (lpString=".ai5") returned 4
	[0076.526] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0076.526] lstrlenW (lpString=".ai6") returned 4
	[0076.526] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0076.526] lstrlenW (lpString=".ai7") returned 4
	[0076.526] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0076.526] lstrlenW (lpString=".ai8") returned 4
	[0076.527] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0076.527] lstrlenW (lpString=".anim") returned 5
	[0076.527] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0076.527] lstrlenW (lpString=".arw") returned 4
	[0076.527] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0076.527] lstrlenW (lpString=".as") returned 3
	[0076.528] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0076.528] lstrlenW (lpString=".asa") returned 4
	[0076.528] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0076.528] lstrlenW (lpString=".asc") returned 4
	[0076.528] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0076.528] lstrlenW (lpString=".ascx") returned 5
	[0076.529] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0076.529] lstrlenW (lpString=".asm") returned 4
	[0076.529] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0076.529] lstrlenW (lpString=".asmx") returned 5
	[0076.529] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0076.529] lstrlenW (lpString=".asp") returned 4
	[0076.530] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0076.530] lstrlenW (lpString=".aspx") returned 5
	[0076.530] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0076.530] lstrlenW (lpString=".asr") returned 4
	[0076.530] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0076.531] lstrlenW (lpString=".asx") returned 4
	[0076.531] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0076.531] lstrlenW (lpString=".avi") returned 4
	[0076.531] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0076.531] lstrlenW (lpString=".avs") returned 4
	[0076.531] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0076.531] lstrlenW (lpString=".backup") returned 7
	[0076.532] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0076.532] lstrlenW (lpString=".bak") returned 4
	[0076.532] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0076.532] lstrlenW (lpString=".bay") returned 4
	[0076.532] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0076.532] lstrlenW (lpString=".bd") returned 3
	[0076.533] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0076.533] lstrlenW (lpString=".bin") returned 4
	[0076.533] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0076.533] lstrlenW (lpString=".bmp") returned 4
	[0076.533] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0076.533] lstrlenW (lpString=".bz2") returned 4
	[0076.534] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0076.534] lstrlenW (lpString=".c") returned 2
	[0076.534] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0076.534] lstrlenW (lpString=".cdr") returned 4
	[0076.535] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0076.535] lstrlenW (lpString=".cer") returned 4
	[0076.535] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0076.535] lstrlenW (lpString=".cf") returned 3
	[0076.535] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0076.535] lstrlenW (lpString=".cfc") returned 4
	[0076.536] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0076.536] lstrlenW (lpString=".cfm") returned 4
	[0076.536] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0076.536] lstrlenW (lpString=".cfml") returned 5
	[0076.536] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0076.536] lstrlenW (lpString=".cfu") returned 4
	[0076.537] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0076.537] lstrlenW (lpString=".chm") returned 4
	[0076.537] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0076.537] lstrlenW (lpString=".cin") returned 4
	[0076.537] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0076.538] lstrlenW (lpString=".class") returned 6
	[0076.538] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0076.538] lstrlenW (lpString=".clx") returned 4
	[0076.538] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0076.538] lstrlenW (lpString=".config") returned 7
	[0076.538] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0076.539] lstrlenW (lpString=".cpp") returned 4
	[0076.539] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0076.539] lstrlenW (lpString=".cr2") returned 4
	[0076.539] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0076.539] lstrlenW (lpString=".crt") returned 4
	[0076.540] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0076.540] lstrlenW (lpString=".crw") returned 4
	[0076.540] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0076.540] lstrlenW (lpString=".cs") returned 3
	[0076.540] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0076.540] lstrlenW (lpString=".css") returned 4
	[0076.541] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0076.541] lstrlenW (lpString=".csv") returned 4
	[0076.541] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0076.541] lstrlenW (lpString=".cub") returned 4
	[0076.541] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0076.541] lstrlenW (lpString=".dae") returned 4
	[0076.542] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0076.542] lstrlenW (lpString=".dat") returned 4
	[0076.542] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0076.542] lstrlenW (lpString=".db") returned 3
	[0076.542] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0076.542] lstrlenW (lpString=".dbf") returned 4
	[0076.542] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0076.543] lstrlenW (lpString=".dbx") returned 4
	[0076.543] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0076.543] lstrlenW (lpString=".dc3") returned 4
	[0076.543] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0076.543] lstrlenW (lpString=".dcm") returned 4
	[0076.543] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0076.543] lstrlenW (lpString=".dcr") returned 4
	[0076.544] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0076.544] lstrlenW (lpString=".der") returned 4
	[0076.544] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0076.544] lstrlenW (lpString=".dib") returned 4
	[0076.544] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0076.544] lstrlenW (lpString=".dic") returned 4
	[0076.545] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0076.545] lstrlenW (lpString=".dif") returned 4
	[0076.545] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0076.545] lstrlenW (lpString=".divx") returned 5
	[0076.545] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0076.545] lstrlenW (lpString=".djvu") returned 5
	[0076.546] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0076.546] lstrlenW (lpString=".dng") returned 4
	[0076.546] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0076.546] lstrlenW (lpString=".doc") returned 4
	[0076.546] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0076.546] lstrlenW (lpString=".docm") returned 5
	[0076.546] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0076.547] lstrlenW (lpString=".docx") returned 5
	[0076.547] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0076.547] lstrlenW (lpString=".dot") returned 4
	[0076.547] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0076.547] lstrlenW (lpString=".dotm") returned 5
	[0076.547] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0076.547] lstrlenW (lpString=".dotx") returned 5
	[0076.548] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0076.548] lstrlenW (lpString=".dpx") returned 4
	[0076.548] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0076.548] lstrlenW (lpString=".dqy") returned 4
	[0076.548] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0076.548] lstrlenW (lpString=".dsn") returned 4
	[0076.548] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0076.549] lstrlenW (lpString=".dt") returned 3
	[0076.549] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0076.549] lstrlenW (lpString=".dtd") returned 4
	[0076.549] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0076.549] lstrlenW (lpString=".dwg") returned 4
	[0076.549] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0076.746] lstrlenW (lpString=".dwt") returned 4
	[0076.746] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0076.747] lstrlenW (lpString=".dx") returned 3
	[0076.747] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0076.747] lstrlenW (lpString=".dxf") returned 4
	[0076.747] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0076.747] lstrlenW (lpString=".edml") returned 5
	[0076.747] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0076.748] lstrlenW (lpString=".efd") returned 4
	[0076.748] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0076.748] lstrlenW (lpString=".elf") returned 4
	[0076.748] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0076.748] lstrlenW (lpString=".emf") returned 4
	[0076.749] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0076.749] lstrlenW (lpString=".emz") returned 4
	[0076.749] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0076.749] lstrlenW (lpString=".epf") returned 4
	[0076.749] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0076.749] lstrlenW (lpString=".eps") returned 4
	[0076.750] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0076.750] lstrlenW (lpString=".epsf") returned 5
	[0076.750] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0076.750] lstrlenW (lpString=".epsp") returned 5
	[0076.750] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0076.751] lstrlenW (lpString=".erf") returned 4
	[0076.751] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0076.751] lstrlenW (lpString=".exr") returned 4
	[0076.751] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0076.751] lstrlenW (lpString=".f4v") returned 4
	[0076.751] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0076.752] lstrlenW (lpString=".fido") returned 5
	[0076.752] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0076.752] lstrlenW (lpString=".flm") returned 4
	[0076.752] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0076.752] lstrlenW (lpString=".flv") returned 4
	[0076.753] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0076.753] lstrlenW (lpString=".frm") returned 4
	[0076.753] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0076.753] lstrlenW (lpString=".fxg") returned 4
	[0076.753] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0076.753] lstrlenW (lpString=".geo") returned 4
	[0076.754] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0076.754] lstrlenW (lpString=".gif") returned 4
	[0076.754] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0076.754] lstrlenW (lpString=".grs") returned 4
	[0076.754] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0076.754] lstrlenW (lpString=".gz") returned 3
	[0076.755] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0076.755] lstrlenW (lpString=".h") returned 2
	[0076.755] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0076.755] lstrlenW (lpString=".hdr") returned 4
	[0076.755] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0076.755] lstrlenW (lpString=".hpp") returned 4
	[0076.756] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0076.756] lstrlenW (lpString=".hta") returned 4
	[0076.756] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0076.756] lstrlenW (lpString=".htc") returned 4
	[0076.756] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0076.756] lstrlenW (lpString=".htm") returned 4
	[0076.756] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0076.757] lstrlenW (lpString=".html") returned 5
	[0076.757] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0076.757] lstrlenW (lpString=".icb") returned 4
	[0076.757] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0076.757] lstrlenW (lpString=".ics") returned 4
	[0076.757] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0076.757] lstrlenW (lpString=".iff") returned 4
	[0076.758] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0076.758] lstrlenW (lpString=".inc") returned 4
	[0076.758] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0076.758] lstrlenW (lpString=".indd") returned 5
	[0076.758] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0076.758] lstrlenW (lpString=".ini") returned 4
	[0076.758] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0076.759] lstrlenW (lpString=".iqy") returned 4
	[0076.759] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0076.759] lstrlenW (lpString=".j2c") returned 4
	[0076.759] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0076.759] lstrlenW (lpString=".j2k") returned 4
	[0076.759] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0076.759] lstrlenW (lpString=".java") returned 5
	[0076.759] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0076.760] lstrlenW (lpString=".jp2") returned 4
	[0076.760] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0076.760] lstrlenW (lpString=".jpc") returned 4
	[0076.760] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0076.760] lstrlenW (lpString=".jpe") returned 4
	[0076.760] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0076.760] lstrlenW (lpString=".jpeg") returned 5
	[0076.761] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0076.761] lstrlenW (lpString=".jpf") returned 4
	[0076.761] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0076.761] lstrlenW (lpString=".jpg") returned 4
	[0076.761] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0076.761] lstrlenW (lpString=".jpx") returned 4
	[0076.761] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0076.762] lstrlenW (lpString=".js") returned 3
	[0076.762] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0076.762] lstrlenW (lpString=".jsf") returned 4
	[0076.762] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0076.762] lstrlenW (lpString=".json") returned 5
	[0076.762] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0076.763] lstrlenW (lpString=".jsp") returned 4
	[0076.763] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0076.763] lstrlenW (lpString=".kdc") returned 4
	[0076.763] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0076.763] lstrlenW (lpString=".kmz") returned 4
	[0076.763] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0076.763] lstrlenW (lpString=".kwm") returned 4
	[0076.763] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0076.764] lstrlenW (lpString=".lasso") returned 6
	[0076.764] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0076.764] lstrlenW (lpString=".lbi") returned 4
	[0076.764] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0076.764] lstrlenW (lpString=".lgf") returned 4
	[0076.764] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0076.764] lstrlenW (lpString=".lgp") returned 4
	[0076.765] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0076.765] lstrlenW (lpString=".log") returned 4
	[0076.765] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0076.765] lstrlenW (lpString=".m1v") returned 4
	[0076.765] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0076.765] lstrlenW (lpString=".m4a") returned 4
	[0076.765] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0076.766] lstrlenW (lpString=".m4v") returned 4
	[0076.766] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0076.766] lstrlenW (lpString=".max") returned 4
	[0076.766] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0076.766] lstrlenW (lpString=".md") returned 3
	[0076.766] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0076.766] lstrlenW (lpString=".mda") returned 4
	[0076.767] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0076.767] lstrlenW (lpString=".mdb") returned 4
	[0076.767] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0076.767] lstrlenW (lpString=".mde") returned 4
	[0076.767] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0076.767] lstrlenW (lpString=".mdf") returned 4
	[0076.767] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0076.768] lstrlenW (lpString=".mdw") returned 4
	[0076.768] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0076.768] lstrlenW (lpString=".mef") returned 4
	[0076.768] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0076.768] lstrlenW (lpString=".mft") returned 4
	[0076.768] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0076.768] lstrlenW (lpString=".mfw") returned 4
	[0076.770] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0076.771] lstrlenW (lpString=".mht") returned 4
	[0076.771] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0076.771] lstrlenW (lpString=".mhtml") returned 6
	[0076.771] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0076.771] lstrlenW (lpString=".mka") returned 4
	[0076.771] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0076.772] lstrlenW (lpString=".mkidx") returned 6
	[0076.772] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0076.772] lstrlenW (lpString=".mkv") returned 4
	[0076.772] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0076.772] lstrlenW (lpString=".mos") returned 4
	[0076.772] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0076.772] lstrlenW (lpString=".mov") returned 4
	[0076.773] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0076.773] lstrlenW (lpString=".mp3") returned 4
	[0076.773] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0076.773] lstrlenW (lpString=".mp4") returned 4
	[0076.773] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0076.773] lstrlenW (lpString=".mpeg") returned 5
	[0076.773] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0076.774] lstrlenW (lpString=".mpg") returned 4
	[0076.774] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0076.774] lstrlenW (lpString=".mpv") returned 4
	[0076.774] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0076.774] lstrlenW (lpString=".mrw") returned 4
	[0076.774] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0076.774] lstrlenW (lpString=".msg") returned 4
	[0076.775] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0076.775] lstrlenW (lpString=".mxl") returned 4
	[0076.775] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0076.775] lstrlenW (lpString=".myd") returned 4
	[0076.775] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0076.775] lstrlenW (lpString=".myi") returned 4
	[0076.776] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0076.776] lstrlenW (lpString=".nef") returned 4
	[0076.776] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0076.776] lstrlenW (lpString=".nrw") returned 4
	[0076.776] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0076.776] lstrlenW (lpString=".obj") returned 4
	[0076.776] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0076.777] lstrlenW (lpString=".odb") returned 4
	[0076.777] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0076.777] lstrlenW (lpString=".odc") returned 4
	[0076.777] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0076.777] lstrlenW (lpString=".odm") returned 4
	[0076.777] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0076.778] lstrlenW (lpString=".odp") returned 4
	[0076.778] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0076.778] lstrlenW (lpString=".ods") returned 4
	[0076.778] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0076.778] lstrlenW (lpString=".oft") returned 4
	[0076.778] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0076.778] lstrlenW (lpString=".one") returned 4
	[0076.779] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0076.779] lstrlenW (lpString=".onepkg") returned 7
	[0076.779] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0076.779] lstrlenW (lpString=".onetoc2") returned 8
	[0076.779] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0076.779] lstrlenW (lpString=".opt") returned 4
	[0076.780] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0076.780] lstrlenW (lpString=".oqy") returned 4
	[0076.780] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0076.780] lstrlenW (lpString=".orf") returned 4
	[0076.780] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0076.780] lstrlenW (lpString=".p12") returned 4
	[0076.781] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0076.781] lstrlenW (lpString=".p7b") returned 4
	[0076.781] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0076.781] lstrlenW (lpString=".p7c") returned 4
	[0076.781] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0076.781] lstrlenW (lpString=".pam") returned 4
	[0076.781] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0076.782] lstrlenW (lpString=".pbm") returned 4
	[0076.782] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0076.782] lstrlenW (lpString=".pct") returned 4
	[0076.782] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0076.782] lstrlenW (lpString=".pcx") returned 4
	[0076.782] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0076.782] lstrlenW (lpString=".pdd") returned 4
	[0076.783] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0076.783] lstrlenW (lpString=".pdf") returned 4
	[0076.783] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0076.783] lstrlenW (lpString=".pdp") returned 4
	[0076.783] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0076.783] lstrlenW (lpString=".pef") returned 4
	[0076.784] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0076.784] lstrlenW (lpString=".pem") returned 4
	[0076.784] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0076.784] lstrlenW (lpString=".pff") returned 4
	[0076.784] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0076.784] lstrlenW (lpString=".pfm") returned 4
	[0076.785] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0076.785] lstrlenW (lpString=".pfx") returned 4
	[0076.785] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0076.785] lstrlenW (lpString=".pgm") returned 4
	[0076.785] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0076.785] lstrlenW (lpString=".php") returned 4
	[0076.854] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0076.854] lstrlenW (lpString=".php3") returned 5
	[0076.854] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0076.854] lstrlenW (lpString=".php4") returned 5
	[0076.854] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0076.854] lstrlenW (lpString=".php5") returned 5
	[0076.855] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0076.855] lstrlenW (lpString=".phtml") returned 6
	[0076.855] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0076.855] lstrlenW (lpString=".pict") returned 5
	[0076.855] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0076.855] lstrlenW (lpString=".pl") returned 3
	[0076.856] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0076.856] lstrlenW (lpString=".pls") returned 4
	[0076.856] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0076.856] lstrlenW (lpString=".pm") returned 3
	[0076.856] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0076.856] lstrlenW (lpString=".png") returned 4
	[0076.856] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0076.857] lstrlenW (lpString=".pnm") returned 4
	[0076.857] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0076.857] lstrlenW (lpString=".pot") returned 4
	[0076.857] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0076.857] lstrlenW (lpString=".potm") returned 5
	[0076.857] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0076.858] lstrlenW (lpString=".potx") returned 5
	[0076.858] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0076.858] lstrlenW (lpString=".ppa") returned 4
	[0076.858] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0076.858] lstrlenW (lpString=".ppam") returned 5
	[0076.858] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0076.858] lstrlenW (lpString=".ppm") returned 4
	[0076.859] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0076.859] lstrlenW (lpString=".pps") returned 4
	[0076.859] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0076.859] lstrlenW (lpString=".ppsm") returned 5
	[0076.859] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0076.859] lstrlenW (lpString=".ppt") returned 4
	[0076.860] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0076.860] lstrlenW (lpString=".pptm") returned 5
	[0076.860] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0076.860] lstrlenW (lpString=".pptx") returned 5
	[0076.860] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0076.860] lstrlenW (lpString=".prn") returned 4
	[0076.860] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0076.861] lstrlenW (lpString=".ps") returned 3
	[0076.861] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0076.861] lstrlenW (lpString=".psb") returned 4
	[0076.861] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0076.861] lstrlenW (lpString=".psd") returned 4
	[0076.861] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0076.862] lstrlenW (lpString=".pst") returned 4
	[0076.862] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0076.862] lstrlenW (lpString=".ptx") returned 4
	[0076.862] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0076.862] lstrlenW (lpString=".pub") returned 4
	[0076.862] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0076.863] lstrlenW (lpString=".pwm") returned 4
	[0076.863] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0076.863] lstrlenW (lpString=".pxr") returned 4
	[0076.863] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0076.863] lstrlenW (lpString=".py") returned 3
	[0076.863] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0076.864] lstrlenW (lpString=".qt") returned 3
	[0076.864] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0076.864] lstrlenW (lpString=".r3d") returned 4
	[0076.864] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0076.864] lstrlenW (lpString=".raf") returned 4
	[0076.864] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0076.864] lstrlenW (lpString=".rar") returned 4
	[0076.865] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0076.865] lstrlenW (lpString=".raw") returned 4
	[0076.865] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0076.865] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.869] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.869] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0076.869] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.869] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.870] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.870] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.871] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.871] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.871] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0076.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.872] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.872] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.872] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.873] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.873] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.873] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0076.874] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.874] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.875] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.876] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.876] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.877] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.877] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0076.878] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.878] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.879] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.879] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.880] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.880] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.880] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0076.881] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.881] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.883] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.883] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.883] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.884] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.884] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0076.884] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.885] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b2d0
	[0076.885] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.885] FindNextFileW (in: hFindFile=0x33b2d0, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0076.886] FindClose (in: hFindFile=0x33b2d0 | out: hFindFile=0x33b2d0) returned 1
	[0076.886] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36a4530 | out: hHeap=0x2e0000) returned 1
	[0076.886] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0076.887] FindClose (in: hFindFile=0x331678 | out: hFindFile=0x331678) returned 1
	[0076.887] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3694528 | out: hHeap=0x2e0000) returned 1
	[0076.887] FindNextFileW (in: hFindFile=0x331638, lpFindFileData=0x3a4fd00 | out: lpFindFileData=0x3a4fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0076.888] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3694528
	[0076.888] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331678
	[0076.889] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.889] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0076.889] FindClose (in: hFindFile=0x331678 | out: hFindFile=0x331678) returned 1
	[0076.889] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3694528 | out: hHeap=0x2e0000) returned 1
	[0076.890] FindNextFileW (in: hFindFile=0x331638, lpFindFileData=0x3a4fd00 | out: lpFindFileData=0x3a4fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0076.890] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3694528
	[0076.890] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="࠰3\x16")) returned 0xffffffff
	[0076.891] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3694528 | out: hHeap=0x2e0000) returned 1
	[0076.891] FindNextFileW (in: hFindFile=0x331638, lpFindFileData=0x3a4fd00 | out: lpFindFileData=0x3a4fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0076.892] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3694528
	[0076.892] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331678
	[0076.970] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0076.970] FindNextFileW (in: hFindFile=0x331678, lpFindFileData=0x3a4fa84 | out: lpFindFileData=0x3a4fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0076.970] lstrlenW (lpString="C:\\MSOCache\\All Users") returned 21
	[0076.971] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users") returned 1
	[0076.971] lstrlenW (lpString="All Users") returned 9
	[0076.971] lstrcmpiW (lpString1="C:\\Windows", lpString2="All Users") returned 1
	[0076.972] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x36a4530
	[0076.972] lstrlenW (lpString="C:\\MSOCache\\All Users") returned 21
	[0076.972] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33a8d8
	[0077.066] FindNextFileW (in: hFindFile=0x33a8d8, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.067] FindNextFileW (in: hFindFile=0x33a8d8, lpFindFileData=0x3a4f808 | out: lpFindFileData=0x3a4f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1
	[0077.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62
	[0077.067] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1
	[0077.068] lstrlenW (lpString="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 40
	[0077.068] lstrcmpiW (lpString1="C:\\Windows", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1
	[0077.068] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3ea1fb8
	[0077.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62
	[0077.070] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x3a4f58c | out: lpFindFileData=0x3a4f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33b310
	[0077.071] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f58c | out: lpFindFileData=0x3a4f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.071] FindNextFileW (in: hFindFile=0x33b310, lpFindFileData=0x3a4f58c | out: lpFindFileData=0x3a4f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1
	[0077.072] lstrlenW (lpString="ExcelLR.cab") returned 11
	[0077.072] lstrlenW (lpString=".1cd") returned 4
	[0077.072] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0077.073] lstrlenW (lpString=".3ds") returned 4
	[0077.073] lstrcmpiW (lpString1=".3ds", lpString2=".cab") returned -1
	[0077.073] lstrlenW (lpString=".3fr") returned 4
	[0077.073] lstrcmpiW (lpString1=".3fr", lpString2=".cab") returned -1
	[0077.073] lstrlenW (lpString=".3g2") returned 4
	[0077.073] lstrcmpiW (lpString1=".3g2", lpString2=".cab") returned -1
	[0077.074] lstrlenW (lpString=".3gp") returned 4
	[0077.074] lstrcmpiW (lpString1=".3gp", lpString2=".cab") returned -1
	[0077.074] lstrlenW (lpString=".7z") returned 3
	[0077.074] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0077.074] lstrlenW (lpString=".accda") returned 6
	[0077.074] lstrcmpiW (lpString1=".accda", lpString2="LR.cab") returned -1
	[0077.075] lstrlenW (lpString=".accdb") returned 6
	[0077.075] lstrcmpiW (lpString1=".accdb", lpString2="LR.cab") returned -1
	[0077.075] lstrlenW (lpString=".accdc") returned 6
	[0077.075] lstrcmpiW (lpString1=".accdc", lpString2="LR.cab") returned -1
	[0077.075] lstrlenW (lpString=".accde") returned 6
	[0077.076] lstrcmpiW (lpString1=".accde", lpString2="LR.cab") returned -1
	[0077.076] lstrlenW (lpString=".accdt") returned 6
	[0077.076] lstrcmpiW (lpString1=".accdt", lpString2="LR.cab") returned -1
	[0077.076] lstrlenW (lpString=".accdw") returned 6
	[0077.076] lstrcmpiW (lpString1=".accdw", lpString2="LR.cab") returned -1
	[0077.076] lstrlenW (lpString=".adb") returned 4
	[0077.077] lstrcmpiW (lpString1=".adb", lpString2=".cab") returned -1
	[0077.077] lstrlenW (lpString=".adp") returned 4
	[0077.077] lstrcmpiW (lpString1=".adp", lpString2=".cab") returned -1
	[0077.077] lstrlenW (lpString=".ai") returned 3
	[0077.077] lstrcmpiW (lpString1=".ai", lpString2="cab") returned -1
	[0077.077] lstrlenW (lpString=".ai3") returned 4
	[0077.077] lstrcmpiW (lpString1=".ai3", lpString2=".cab") returned -1
	[0077.078] lstrlenW (lpString=".ai4") returned 4
	[0077.078] lstrcmpiW (lpString1=".ai4", lpString2=".cab") returned -1
	[0077.078] lstrlenW (lpString=".ai5") returned 4
	[0077.078] lstrcmpiW (lpString1=".ai5", lpString2=".cab") returned -1
	[0077.078] lstrlenW (lpString=".ai6") returned 4
	[0077.078] lstrcmpiW (lpString1=".ai6", lpString2=".cab") returned -1
	[0077.079] lstrlenW (lpString=".ai7") returned 4
	[0077.079] lstrcmpiW (lpString1=".ai7", lpString2=".cab") returned -1
	[0077.079] lstrlenW (lpString=".ai8") returned 4
	[0077.079] lstrcmpiW (lpString1=".ai8", lpString2=".cab") returned -1
	[0077.079] lstrlenW (lpString=".anim") returned 5
	[0077.079] lstrcmpiW (lpString1=".anim", lpString2="R.cab") returned -1
	[0077.080] lstrlenW (lpString=".arw") returned 4
	[0077.080] lstrcmpiW (lpString1=".arw", lpString2=".cab") returned -1
	[0077.080] lstrlenW (lpString=".as") returned 3
	[0077.080] lstrcmpiW (lpString1=".as", lpString2="cab") returned -1
	[0077.080] lstrlenW (lpString=".asa") returned 4
	[0077.081] lstrcmpiW (lpString1=".asa", lpString2=".cab") returned -1
	[0077.081] lstrlenW (lpString=".asc") returned 4
	[0077.081] lstrcmpiW (lpString1=".asc", lpString2=".cab") returned -1
	[0077.081] lstrlenW (lpString=".ascx") returned 5
	[0077.081] lstrcmpiW (lpString1=".ascx", lpString2="R.cab") returned -1
	[0077.082] lstrlenW (lpString=".asm") returned 4
	[0077.082] lstrcmpiW (lpString1=".asm", lpString2=".cab") returned -1
	[0077.082] lstrlenW (lpString=".asmx") returned 5
	[0077.082] lstrcmpiW (lpString1=".asmx", lpString2="R.cab") returned -1
	[0077.082] lstrlenW (lpString=".asp") returned 4
	[0077.082] lstrcmpiW (lpString1=".asp", lpString2=".cab") returned -1
	[0077.083] lstrlenW (lpString=".aspx") returned 5
	[0077.083] lstrcmpiW (lpString1=".aspx", lpString2="R.cab") returned -1
	[0077.083] lstrlenW (lpString=".asr") returned 4
	[0077.083] lstrcmpiW (lpString1=".asr", lpString2=".cab") returned -1
	[0077.083] lstrlenW (lpString=".asx") returned 4
	[0077.083] lstrcmpiW (lpString1=".asx", lpString2=".cab") returned -1
	[0077.084] lstrlenW (lpString=".avi") returned 4
	[0077.084] lstrcmpiW (lpString1=".avi", lpString2=".cab") returned -1
	[0077.084] lstrlenW (lpString=".avs") returned 4
	[0077.084] lstrcmpiW (lpString1=".avs", lpString2=".cab") returned -1
	[0077.084] lstrlenW (lpString=".backup") returned 7
	[0077.084] lstrcmpiW (lpString1=".backup", lpString2="lLR.cab") returned -1
	[0077.085] lstrlenW (lpString=".bak") returned 4
	[0077.085] lstrcmpiW (lpString1=".bak", lpString2=".cab") returned -1
	[0077.085] lstrlenW (lpString=".bay") returned 4
	[0077.085] lstrcmpiW (lpString1=".bay", lpString2=".cab") returned -1
	[0077.085] lstrlenW (lpString=".bd") returned 3
	[0077.085] lstrcmpiW (lpString1=".bd", lpString2="cab") returned -1
	[0077.086] lstrlenW (lpString=".bin") returned 4
	[0077.086] lstrcmpiW (lpString1=".bin", lpString2=".cab") returned -1
	[0077.086] lstrlenW (lpString=".bmp") returned 4
	[0077.086] lstrcmpiW (lpString1=".bmp", lpString2=".cab") returned -1
	[0077.086] lstrlenW (lpString=".bz2") returned 4
	[0077.086] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0077.087] lstrlenW (lpString=".c") returned 2
	[0077.087] lstrcmpiW (lpString1=".c", lpString2="ab") returned -1
	[0077.087] lstrlenW (lpString=".cdr") returned 4
	[0077.087] lstrcmpiW (lpString1=".cdr", lpString2=".cab") returned 1
	[0077.087] lstrlenW (lpString=".cer") returned 4
	[0077.087] lstrcmpiW (lpString1=".cer", lpString2=".cab") returned 1
	[0077.088] lstrlenW (lpString=".cf") returned 3
	[0077.088] lstrcmpiW (lpString1=".cf", lpString2="cab") returned -1
	[0077.088] lstrlenW (lpString=".cfc") returned 4
	[0077.088] lstrcmpiW (lpString1=".cfc", lpString2=".cab") returned 1
	[0077.088] lstrlenW (lpString=".cfm") returned 4
	[0077.088] lstrcmpiW (lpString1=".cfm", lpString2=".cab") returned 1
	[0077.089] lstrlenW (lpString=".cfml") returned 5
	[0077.089] lstrcmpiW (lpString1=".cfml", lpString2="R.cab") returned -1
	[0077.089] lstrlenW (lpString=".cfu") returned 4
	[0077.089] lstrcmpiW (lpString1=".cfu", lpString2=".cab") returned 1
	[0077.089] lstrlenW (lpString=".chm") returned 4
	[0077.089] lstrcmpiW (lpString1=".chm", lpString2=".cab") returned 1
	[0077.089] lstrlenW (lpString=".cin") returned 4
	[0077.090] lstrcmpiW (lpString1=".cin", lpString2=".cab") returned 1
	[0077.090] lstrlenW (lpString=".class") returned 6
	[0077.090] lstrcmpiW (lpString1=".class", lpString2="LR.cab") returned -1
	[0077.090] lstrlenW (lpString=".clx") returned 4
	[0077.090] lstrcmpiW (lpString1=".clx", lpString2=".cab") returned 1
	[0077.090] lstrlenW (lpString=".config") returned 7
	[0077.091] lstrcmpiW (lpString1=".config", lpString2="lLR.cab") returned -1
	[0077.091] lstrlenW (lpString=".cpp") returned 4
	[0077.091] lstrcmpiW (lpString1=".cpp", lpString2=".cab") returned 1
	[0077.091] lstrlenW (lpString=".cr2") returned 4
	[0077.091] lstrcmpiW (lpString1=".cr2", lpString2=".cab") returned 1
	[0077.091] lstrlenW (lpString=".crt") returned 4
	[0077.092] lstrcmpiW (lpString1=".crt", lpString2=".cab") returned 1
	[0077.092] lstrlenW (lpString=".crw") returned 4
	[0077.092] lstrcmpiW (lpString1=".crw", lpString2=".cab") returned 1
	[0077.092] lstrlenW (lpString=".cs") returned 3
	[0077.092] lstrcmpiW (lpString1=".cs", lpString2="cab") returned -1
	[0077.092] lstrlenW (lpString=".css") returned 4
	[0077.092] lstrcmpiW (lpString1=".css", lpString2=".cab") returned 1
	[0077.093] lstrlenW (lpString=".csv") returned 4
	[0077.093] lstrcmpiW (lpString1=".csv", lpString2=".cab") returned 1
	[0077.093] lstrlenW (lpString=".cub") returned 4
	[0077.093] lstrcmpiW (lpString1=".cub", lpString2=".cab") returned 1
	[0077.093] lstrlenW (lpString=".dae") returned 4
	[0077.093] lstrcmpiW (lpString1=".dae", lpString2=".cab") returned 1
	[0077.094] lstrlenW (lpString=".dat") returned 4
	[0077.094] lstrcmpiW (lpString1=".dat", lpString2=".cab") returned 1
	[0077.094] lstrlenW (lpString=".db") returned 3
	[0077.094] lstrcmpiW (lpString1=".db", lpString2="cab") returned -1
	[0077.094] lstrlenW (lpString=".dbf") returned 4
	[0077.094] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0077.094] lstrlenW (lpString=".dbx") returned 4
	[0077.094] lstrcmpiW (lpString1=".dbx", lpString2=".cab") returned 1
	[0077.095] lstrlenW (lpString=".dc3") returned 4
	[0077.095] lstrcmpiW (lpString1=".dc3", lpString2=".cab") returned 1
	[0077.095] lstrlenW (lpString=".dcm") returned 4
	[0077.095] lstrcmpiW (lpString1=".dcm", lpString2=".cab") returned 1
	[0077.095] lstrlenW (lpString=".dcr") returned 4
	[0077.095] lstrcmpiW (lpString1=".dcr", lpString2=".cab") returned 1
	[0077.177] lstrlenW (lpString=".der") returned 4
	[0077.178] lstrcmpiW (lpString1=".der", lpString2=".cab") returned 1
	[0077.178] lstrlenW (lpString=".dib") returned 4
	[0077.178] lstrcmpiW (lpString1=".dib", lpString2=".cab") returned 1
	[0077.178] lstrlenW (lpString=".dic") returned 4
	[0077.178] lstrcmpiW (lpString1=".dic", lpString2=".cab") returned 1
	[0077.178] lstrlenW (lpString=".dif") returned 4
	[0077.179] lstrcmpiW (lpString1=".dif", lpString2=".cab") returned 1
	[0077.179] lstrlenW (lpString=".divx") returned 5
	[0077.179] lstrcmpiW (lpString1=".divx", lpString2="R.cab") returned -1
	[0077.179] lstrlenW (lpString=".djvu") returned 5
	[0077.179] lstrcmpiW (lpString1=".djvu", lpString2="R.cab") returned -1
	[0077.179] lstrlenW (lpString=".dng") returned 4
	[0077.179] lstrcmpiW (lpString1=".dng", lpString2=".cab") returned 1
	[0077.180] lstrlenW (lpString=".doc") returned 4
	[0077.180] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0077.180] lstrlenW (lpString=".docm") returned 5
	[0077.180] lstrcmpiW (lpString1=".docm", lpString2="R.cab") returned -1
	[0077.180] lstrlenW (lpString=".docx") returned 5
	[0077.180] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0077.181] lstrlenW (lpString=".dot") returned 4
	[0077.181] lstrcmpiW (lpString1=".dot", lpString2=".cab") returned 1
	[0077.181] lstrlenW (lpString=".dotm") returned 5
	[0077.181] lstrcmpiW (lpString1=".dotm", lpString2="R.cab") returned -1
	[0077.181] lstrlenW (lpString=".dotx") returned 5
	[0077.181] lstrcmpiW (lpString1=".dotx", lpString2="R.cab") returned -1
	[0077.182] lstrlenW (lpString=".dpx") returned 4
	[0077.182] lstrcmpiW (lpString1=".dpx", lpString2=".cab") returned 1
	[0077.182] lstrlenW (lpString=".dqy") returned 4
	[0077.182] lstrcmpiW (lpString1=".dqy", lpString2=".cab") returned 1
	[0077.182] lstrlenW (lpString=".dsn") returned 4
	[0077.182] lstrcmpiW (lpString1=".dsn", lpString2=".cab") returned 1
	[0077.182] lstrlenW (lpString=".dt") returned 3
	[0077.183] lstrcmpiW (lpString1=".dt", lpString2="cab") returned -1
	[0077.183] lstrlenW (lpString=".dtd") returned 4
	[0077.183] lstrcmpiW (lpString1=".dtd", lpString2=".cab") returned 1
	[0077.183] lstrlenW (lpString=".dwg") returned 4
	[0077.183] lstrcmpiW (lpString1=".dwg", lpString2=".cab") returned 1
	[0077.183] lstrlenW (lpString=".dwt") returned 4
	[0077.184] lstrcmpiW (lpString1=".dwt", lpString2=".cab") returned 1
	[0077.184] lstrlenW (lpString=".dx") returned 3
	[0077.184] lstrcmpiW (lpString1=".dx", lpString2="cab") returned -1
	[0077.184] lstrlenW (lpString=".dxf") returned 4
	[0077.184] lstrcmpiW (lpString1=".dxf", lpString2=".cab") returned 1
	[0077.184] lstrlenW (lpString=".edml") returned 5
	[0077.185] lstrcmpiW (lpString1=".edml", lpString2="R.cab") returned -1
	[0077.185] lstrlenW (lpString=".efd") returned 4
	[0077.185] lstrcmpiW (lpString1=".efd", lpString2=".cab") returned 1
	[0077.185] lstrlenW (lpString=".elf") returned 4
	[0077.185] lstrcmpiW (lpString1=".elf", lpString2=".cab") returned 1
	[0077.185] lstrlenW (lpString=".emf") returned 4
	[0077.186] lstrcmpiW (lpString1=".emf", lpString2=".cab") returned 1
	[0077.186] lstrlenW (lpString=".emz") returned 4
	[0077.186] lstrcmpiW (lpString1=".emz", lpString2=".cab") returned 1
	[0077.186] lstrlenW (lpString=".epf") returned 4
	[0077.186] lstrcmpiW (lpString1=".epf", lpString2=".cab") returned 1
	[0077.186] lstrlenW (lpString=".eps") returned 4
	[0077.187] lstrcmpiW (lpString1=".eps", lpString2=".cab") returned 1
	[0077.187] lstrlenW (lpString=".epsf") returned 5
	[0077.187] lstrcmpiW (lpString1=".epsf", lpString2="R.cab") returned -1
	[0077.187] lstrlenW (lpString=".epsp") returned 5
	[0077.187] lstrcmpiW (lpString1=".epsp", lpString2="R.cab") returned -1
	[0077.187] lstrlenW (lpString=".erf") returned 4
	[0077.188] lstrcmpiW (lpString1=".erf", lpString2=".cab") returned 1
	[0077.188] lstrlenW (lpString=".exr") returned 4
	[0077.188] lstrcmpiW (lpString1=".exr", lpString2=".cab") returned 1
	[0077.188] lstrlenW (lpString=".f4v") returned 4
	[0077.188] lstrcmpiW (lpString1=".f4v", lpString2=".cab") returned 1
	[0077.188] lstrlenW (lpString=".fido") returned 5
	[0077.188] lstrcmpiW (lpString1=".fido", lpString2="R.cab") returned -1
	[0077.189] lstrlenW (lpString=".flm") returned 4
	[0077.189] lstrcmpiW (lpString1=".flm", lpString2=".cab") returned 1
	[0077.189] lstrlenW (lpString=".flv") returned 4
	[0077.189] lstrcmpiW (lpString1=".flv", lpString2=".cab") returned 1
	[0077.189] lstrlenW (lpString=".frm") returned 4
	[0077.189] lstrcmpiW (lpString1=".frm", lpString2=".cab") returned 1
	[0077.190] lstrlenW (lpString=".fxg") returned 4
	[0077.190] lstrcmpiW (lpString1=".fxg", lpString2=".cab") returned 1
	[0077.190] lstrlenW (lpString=".geo") returned 4
	[0077.190] lstrcmpiW (lpString1=".geo", lpString2=".cab") returned 1
	[0077.190] lstrlenW (lpString=".gif") returned 4
	[0077.190] lstrcmpiW (lpString1=".gif", lpString2=".cab") returned 1
	[0077.190] lstrlenW (lpString=".grs") returned 4
	[0077.191] lstrcmpiW (lpString1=".grs", lpString2=".cab") returned 1
	[0077.191] lstrlenW (lpString=".gz") returned 3
	[0077.191] lstrcmpiW (lpString1=".gz", lpString2="cab") returned -1
	[0077.191] lstrlenW (lpString=".h") returned 2
	[0077.191] lstrcmpiW (lpString1=".h", lpString2="ab") returned -1
	[0077.191] lstrlenW (lpString=".hdr") returned 4
	[0077.191] lstrcmpiW (lpString1=".hdr", lpString2=".cab") returned 1
	[0077.192] lstrlenW (lpString=".hpp") returned 4
	[0077.192] lstrcmpiW (lpString1=".hpp", lpString2=".cab") returned 1
	[0077.192] lstrlenW (lpString=".hta") returned 4
	[0077.192] lstrcmpiW (lpString1=".hta", lpString2=".cab") returned 1
	[0077.192] lstrlenW (lpString=".htc") returned 4
	[0077.192] lstrcmpiW (lpString1=".htc", lpString2=".cab") returned 1
	[0077.192] lstrlenW (lpString=".htm") returned 4
	[0077.193] lstrcmpiW (lpString1=".htm", lpString2=".cab") returned 1
	[0077.193] lstrlenW (lpString=".html") returned 5
	[0077.193] lstrcmpiW (lpString1=".html", lpString2="R.cab") returned -1
	[0077.193] lstrlenW (lpString=".icb") returned 4
	[0077.193] lstrcmpiW (lpString1=".icb", lpString2=".cab") returned 1
	[0077.193] lstrlenW (lpString=".ics") returned 4
	[0077.193] lstrcmpiW (lpString1=".ics", lpString2=".cab") returned 1
	[0077.194] lstrlenW (lpString=".iff") returned 4
	[0077.194] lstrcmpiW (lpString1=".iff", lpString2=".cab") returned 1
	[0077.194] lstrlenW (lpString=".inc") returned 4
	[0077.194] lstrcmpiW (lpString1=".inc", lpString2=".cab") returned 1
	[0077.194] lstrlenW (lpString=".indd") returned 5
	[0077.194] lstrcmpiW (lpString1=".indd", lpString2="R.cab") returned -1
	[0077.194] lstrlenW (lpString=".ini") returned 4
	[0077.195] lstrcmpiW (lpString1=".ini", lpString2=".cab") returned 1
	[0077.195] lstrlenW (lpString=".iqy") returned 4
	[0077.195] lstrcmpiW (lpString1=".iqy", lpString2=".cab") returned 1
	[0077.195] lstrlenW (lpString=".j2c") returned 4
	[0077.195] lstrcmpiW (lpString1=".j2c", lpString2=".cab") returned 1
	[0077.195] lstrlenW (lpString=".j2k") returned 4
	[0077.195] lstrcmpiW (lpString1=".j2k", lpString2=".cab") returned 1
	[0077.196] lstrlenW (lpString=".java") returned 5
	[0077.196] lstrcmpiW (lpString1=".java", lpString2="R.cab") returned -1
	[0077.196] lstrlenW (lpString=".jp2") returned 4
	[0077.196] lstrcmpiW (lpString1=".jp2", lpString2=".cab") returned 1
	[0077.196] lstrlenW (lpString=".jpc") returned 4
	[0077.196] lstrcmpiW (lpString1=".jpc", lpString2=".cab") returned 1
	[0077.196] lstrlenW (lpString=".jpe") returned 4
	[0077.197] lstrcmpiW (lpString1=".jpe", lpString2=".cab") returned 1
	[0077.197] lstrlenW (lpString=".jpeg") returned 5
	[0077.197] lstrcmpiW (lpString1=".jpeg", lpString2="R.cab") returned -1
	[0077.197] lstrlenW (lpString=".jpf") returned 4
	[0077.197] lstrcmpiW (lpString1=".jpf", lpString2=".cab") returned 1
	[0077.197] lstrlenW (lpString=".jpg") returned 4
	[0077.197] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0077.198] lstrlenW (lpString=".jpx") returned 4
	[0077.198] lstrcmpiW (lpString1=".jpx", lpString2=".cab") returned 1
	[0077.198] lstrlenW (lpString=".js") returned 3
	[0077.198] lstrcmpiW (lpString1=".js", lpString2="cab") returned -1
	[0077.198] lstrlenW (lpString=".jsf") returned 4
	[0077.198] lstrcmpiW (lpString1=".jsf", lpString2=".cab") returned 1
	[0077.198] lstrlenW (lpString=".json") returned 5
	[0077.199] lstrcmpiW (lpString1=".json", lpString2="R.cab") returned -1
	[0077.199] lstrlenW (lpString=".jsp") returned 4
	[0077.199] lstrcmpiW (lpString1=".jsp", lpString2=".cab") returned 1
	[0077.199] lstrlenW (lpString=".kdc") returned 4
	[0077.199] lstrcmpiW (lpString1=".kdc", lpString2=".cab") returned 1
	[0077.199] lstrlenW (lpString=".kmz") returned 4
	[0077.199] lstrcmpiW (lpString1=".kmz", lpString2=".cab") returned 1
	[0077.199] lstrlenW (lpString=".kwm") returned 4
	[0077.200] lstrcmpiW (lpString1=".kwm", lpString2=".cab") returned 1
	[0077.200] lstrlenW (lpString=".lasso") returned 6
	[0077.200] lstrcmpiW (lpString1=".lasso", lpString2="LR.cab") returned -1
	[0077.200] lstrlenW (lpString=".lbi") returned 4
	[0077.200] lstrcmpiW (lpString1=".lbi", lpString2=".cab") returned 1
	[0077.200] lstrlenW (lpString=".lgf") returned 4
	[0077.200] lstrcmpiW (lpString1=".lgf", lpString2=".cab") returned 1
	[0077.201] lstrlenW (lpString=".lgp") returned 4
	[0077.201] lstrcmpiW (lpString1=".lgp", lpString2=".cab") returned 1
	[0077.201] lstrlenW (lpString=".log") returned 4
	[0077.201] lstrcmpiW (lpString1=".log", lpString2=".cab") returned 1
	[0077.201] lstrlenW (lpString=".m1v") returned 4
	[0077.201] lstrcmpiW (lpString1=".m1v", lpString2=".cab") returned 1
	[0077.201] lstrlenW (lpString=".m4a") returned 4
	[0077.202] lstrcmpiW (lpString1=".m4a", lpString2=".cab") returned 1
	[0077.202] lstrlenW (lpString=".m4v") returned 4
	[0077.202] lstrcmpiW (lpString1=".m4v", lpString2=".cab") returned 1
	[0077.202] lstrlenW (lpString=".max") returned 4
	[0077.202] lstrcmpiW (lpString1=".max", lpString2=".cab") returned 1
	[0077.202] lstrlenW (lpString=".md") returned 3
	[0077.202] lstrcmpiW (lpString1=".md", lpString2="cab") returned -1
	[0077.202] lstrlenW (lpString=".mda") returned 4
	[0077.203] lstrcmpiW (lpString1=".mda", lpString2=".cab") returned 1
	[0077.203] lstrlenW (lpString=".mdb") returned 4
	[0077.203] lstrcmpiW (lpString1=".mdb", lpString2=".cab") returned 1
	[0077.203] lstrlenW (lpString=".mde") returned 4
	[0077.203] lstrcmpiW (lpString1=".mde", lpString2=".cab") returned 1
	[0077.203] lstrlenW (lpString=".mdf") returned 4
	[0077.203] lstrcmpiW (lpString1=".mdf", lpString2=".cab") returned 1
	[0077.204] lstrlenW (lpString=".mdw") returned 4
	[0077.204] lstrcmpiW (lpString1=".mdw", lpString2=".cab") returned 1
	[0077.204] lstrlenW (lpString=".mef") returned 4
	[0077.204] lstrcmpiW (lpString1=".mef", lpString2=".cab") returned 1
	[0077.204] lstrlenW (lpString=".mft") returned 4
	[0077.204] lstrcmpiW (lpString1=".mft", lpString2=".cab") returned 1
	[0077.204] lstrlenW (lpString=".mfw") returned 4
	[0077.205] lstrcmpiW (lpString1=".mfw", lpString2=".cab") returned 1
	[0077.205] lstrlenW (lpString=".mht") returned 4
	[0077.205] lstrcmpiW (lpString1=".mht", lpString2=".cab") returned 1
	[0077.205] lstrlenW (lpString=".mhtml") returned 6
	[0077.205] lstrcmpiW (lpString1=".mhtml", lpString2="LR.cab") returned -1
	[0077.205] lstrlenW (lpString=".mka") returned 4
	[0077.206] lstrcmpiW (lpString1=".mka", lpString2=".cab") returned 1
	[0077.206] lstrlenW (lpString=".mkidx") returned 6
	[0077.206] lstrcmpiW (lpString1=".mkidx", lpString2="LR.cab") returned -1
	[0077.206] lstrlenW (lpString=".mkv") returned 4
	[0077.206] lstrcmpiW (lpString1=".mkv", lpString2=".cab") returned 1
	[0077.206] lstrlenW (lpString=".mos") returned 4
	[0077.206] lstrcmpiW (lpString1=".mos", lpString2=".cab") returned 1
	[0077.207] lstrlenW (lpString=".mov") returned 4
	[0077.207] lstrcmpiW (lpString1=".mov", lpString2=".cab") returned 1
	[0077.207] lstrlenW (lpString=".mp3") returned 4
	[0077.207] lstrcmpiW (lpString1=".mp3", lpString2=".cab") returned 1
	[0077.207] lstrlenW (lpString=".mp4") returned 4
	[0077.207] lstrcmpiW (lpString1=".mp4", lpString2=".cab") returned 1
	[0077.207] lstrlenW (lpString=".mpeg") returned 5
	[0077.208] lstrcmpiW (lpString1=".mpeg", lpString2="R.cab") returned -1
	[0077.208] lstrlenW (lpString=".mpg") returned 4
	[0077.208] lstrcmpiW (lpString1=".mpg", lpString2=".cab") returned 1
	[0077.208] lstrlenW (lpString=".mpv") returned 4
	[0077.208] lstrcmpiW (lpString1=".mpv", lpString2=".cab") returned 1
	[0077.208] lstrlenW (lpString=".mrw") returned 4
	[0077.209] lstrcmpiW (lpString1=".mrw", lpString2=".cab") returned 1
	[0077.209] lstrlenW (lpString=".msg") returned 4
	[0077.209] lstrcmpiW (lpString1=".msg", lpString2=".cab") returned 1
	[0077.209] lstrlenW (lpString=".mxl") returned 4
	[0077.209] lstrcmpiW (lpString1=".mxl", lpString2=".cab") returned 1
	[0077.209] lstrlenW (lpString=".myd") returned 4
	[0077.210] lstrcmpiW (lpString1=".myd", lpString2=".cab") returned 1
	[0077.210] lstrlenW (lpString=".myi") returned 4
	[0077.210] lstrcmpiW (lpString1=".myi", lpString2=".cab") returned 1
	[0077.210] lstrlenW (lpString=".nef") returned 4
	[0077.210] lstrcmpiW (lpString1=".nef", lpString2=".cab") returned 1
	[0077.210] lstrlenW (lpString=".nrw") returned 4
	[0077.211] lstrcmpiW (lpString1=".nrw", lpString2=".cab") returned 1
	[0077.211] lstrlenW (lpString=".obj") returned 4
	[0077.211] lstrcmpiW (lpString1=".obj", lpString2=".cab") returned 1
	[0077.211] lstrlenW (lpString=".odb") returned 4
	[0077.211] lstrcmpiW (lpString1=".odb", lpString2=".cab") returned 1
	[0077.211] lstrlenW (lpString=".odc") returned 4
	[0077.212] lstrcmpiW (lpString1=".odc", lpString2=".cab") returned 1
	[0077.212] lstrlenW (lpString=".odm") returned 4
	[0077.212] lstrcmpiW (lpString1=".odm", lpString2=".cab") returned 1
	[0077.212] lstrlenW (lpString=".odp") returned 4
	[0077.212] lstrcmpiW (lpString1=".odp", lpString2=".cab") returned 1
	[0077.212] lstrlenW (lpString=".ods") returned 4
	[0077.213] lstrcmpiW (lpString1=".ods", lpString2=".cab") returned 1
	[0077.213] lstrlenW (lpString=".oft") returned 4
	[0077.213] lstrcmpiW (lpString1=".oft", lpString2=".cab") returned 1
	[0077.213] lstrlenW (lpString=".one") returned 4
	[0077.213] lstrcmpiW (lpString1=".one", lpString2=".cab") returned 1
	[0077.213] lstrlenW (lpString=".onepkg") returned 7
	[0077.213] lstrcmpiW (lpString1=".onepkg", lpString2="lLR.cab") returned -1
	[0077.214] lstrlenW (lpString=".onetoc2") returned 8
	[0077.214] lstrcmpiW (lpString1=".onetoc2", lpString2="elLR.cab") returned -1
	[0077.214] lstrlenW (lpString=".opt") returned 4
	[0077.214] lstrcmpiW (lpString1=".opt", lpString2=".cab") returned 1
	[0077.214] lstrlenW (lpString=".oqy") returned 4
	[0077.214] lstrcmpiW (lpString1=".oqy", lpString2=".cab") returned 1
	[0077.215] lstrlenW (lpString=".orf") returned 4
	[0077.215] lstrcmpiW (lpString1=".orf", lpString2=".cab") returned 1
	[0077.215] lstrlenW (lpString=".p12") returned 4
	[0077.215] lstrcmpiW (lpString1=".p12", lpString2=".cab") returned 1
	[0077.215] lstrlenW (lpString=".p7b") returned 4
	[0077.215] lstrcmpiW (lpString1=".p7b", lpString2=".cab") returned 1
	[0077.216] lstrlenW (lpString=".p7c") returned 4
	[0077.216] lstrcmpiW (lpString1=".p7c", lpString2=".cab") returned 1
	[0077.216] lstrlenW (lpString=".pam") returned 4
	[0077.216] lstrcmpiW (lpString1=".pam", lpString2=".cab") returned 1
	[0077.216] lstrlenW (lpString=".pbm") returned 4
	[0077.216] lstrcmpiW (lpString1=".pbm", lpString2=".cab") returned 1
	[0077.216] lstrlenW (lpString=".pct") returned 4
	[0077.217] lstrcmpiW (lpString1=".pct", lpString2=".cab") returned 1
	[0077.217] lstrlenW (lpString=".pcx") returned 4
	[0077.217] lstrcmpiW (lpString1=".pcx", lpString2=".cab") returned 1
	[0077.217] lstrlenW (lpString=".pdd") returned 4
	[0077.217] lstrcmpiW (lpString1=".pdd", lpString2=".cab") returned 1
	[0077.217] lstrlenW (lpString=".pdf") returned 4
	[0077.218] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0077.218] lstrlenW (lpString=".pdp") returned 4
	[0077.218] lstrcmpiW (lpString1=".pdp", lpString2=".cab") returned 1
	[0077.218] lstrlenW (lpString=".pef") returned 4
	[0077.218] lstrcmpiW (lpString1=".pef", lpString2=".cab") returned 1
	[0077.218] lstrlenW (lpString=".pem") returned 4
	[0077.218] lstrcmpiW (lpString1=".pem", lpString2=".cab") returned 1
	[0077.219] lstrlenW (lpString=".pff") returned 4
	[0077.219] lstrcmpiW (lpString1=".pff", lpString2=".cab") returned 1
	[0077.219] lstrlenW (lpString=".pfm") returned 4
	[0077.219] lstrcmpiW (lpString1=".pfm", lpString2=".cab") returned 1
	[0077.219] lstrlenW (lpString=".pfx") returned 4
	[0077.219] lstrcmpiW (lpString1=".pfx", lpString2=".cab") returned 1
	[0077.219] lstrlenW (lpString=".pgm") returned 4
	[0077.220] lstrcmpiW (lpString1=".pgm", lpString2=".cab") returned 1
	[0077.220] lstrlenW (lpString=".php") returned 4
	[0077.220] lstrcmpiW (lpString1=".php", lpString2=".cab") returned 1
	[0077.220] lstrlenW (lpString=".php3") returned 5
	[0077.220] lstrcmpiW (lpString1=".php3", lpString2="R.cab") returned -1
	[0077.587] lstrlenW (lpString=".php4") returned 5
	[0077.588] lstrcmpiW (lpString1=".php4", lpString2="R.cab") returned -1
	[0077.588] lstrlenW (lpString=".php5") returned 5
	[0077.588] lstrcmpiW (lpString1=".php5", lpString2="R.cab") returned -1
	[0077.588] lstrlenW (lpString=".phtml") returned 6
	[0077.588] lstrcmpiW (lpString1=".phtml", lpString2="LR.cab") returned -1
	[0077.589] lstrlenW (lpString=".pict") returned 5
	[0077.589] lstrcmpiW (lpString1=".pict", lpString2="R.cab") returned -1
	[0077.589] lstrlenW (lpString=".pl") returned 3
	[0077.589] lstrcmpiW (lpString1=".pl", lpString2="cab") returned -1
	[0077.589] lstrlenW (lpString=".pls") returned 4
	[0077.589] lstrcmpiW (lpString1=".pls", lpString2=".cab") returned 1
	[0077.590] lstrlenW (lpString=".pm") returned 3
	[0077.590] lstrcmpiW (lpString1=".pm", lpString2="cab") returned -1
	[0077.590] lstrlenW (lpString=".png") returned 4
	[0077.590] lstrcmpiW (lpString1=".png", lpString2=".cab") returned 1
	[0077.590] lstrlenW (lpString=".pnm") returned 4
	[0077.590] lstrcmpiW (lpString1=".pnm", lpString2=".cab") returned 1
	[0077.591] lstrlenW (lpString=".pot") returned 4
	[0077.591] lstrcmpiW (lpString1=".pot", lpString2=".cab") returned 1
	[0077.591] lstrlenW (lpString=".potm") returned 5
	[0077.591] lstrcmpiW (lpString1=".potm", lpString2="R.cab") returned -1
	[0077.591] lstrlenW (lpString=".potx") returned 5
	[0077.591] lstrcmpiW (lpString1=".potx", lpString2="R.cab") returned -1
	[0077.592] lstrlenW (lpString=".ppa") returned 4
	[0077.592] lstrcmpiW (lpString1=".ppa", lpString2=".cab") returned 1
	[0077.592] lstrlenW (lpString=".ppam") returned 5
	[0077.592] lstrcmpiW (lpString1=".ppam", lpString2="R.cab") returned -1
	[0077.592] lstrlenW (lpString=".ppm") returned 4
	[0077.592] lstrcmpiW (lpString1=".ppm", lpString2=".cab") returned 1
	[0077.593] lstrlenW (lpString=".pps") returned 4
	[0077.593] lstrcmpiW (lpString1=".pps", lpString2=".cab") returned 1
	[0077.593] lstrlenW (lpString=".ppsm") returned 5
	[0077.593] lstrcmpiW (lpString1=".ppsm", lpString2="R.cab") returned -1
	[0077.593] lstrlenW (lpString=".ppt") returned 4
	[0077.594] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0077.594] lstrlenW (lpString=".pptm") returned 5
	[0077.594] lstrcmpiW (lpString1=".pptm", lpString2="R.cab") returned -1
	[0077.594] lstrlenW (lpString=".pptx") returned 5
	[0077.594] lstrcmpiW (lpString1=".pptx", lpString2="R.cab") returned -1
	[0077.594] lstrlenW (lpString=".prn") returned 4
	[0077.595] lstrcmpiW (lpString1=".prn", lpString2=".cab") returned 1
	[0077.595] lstrlenW (lpString=".ps") returned 3
	[0077.595] lstrcmpiW (lpString1=".ps", lpString2="cab") returned -1
	[0077.595] lstrlenW (lpString=".psb") returned 4
	[0077.595] lstrcmpiW (lpString1=".psb", lpString2=".cab") returned 1
	[0077.595] lstrlenW (lpString=".psd") returned 4
	[0077.596] lstrcmpiW (lpString1=".psd", lpString2=".cab") returned 1
	[0077.596] lstrlenW (lpString=".pst") returned 4
	[0077.596] lstrcmpiW (lpString1=".pst", lpString2=".cab") returned 1
	[0077.596] lstrlenW (lpString=".ptx") returned 4
	[0077.596] lstrcmpiW (lpString1=".ptx", lpString2=".cab") returned 1
	[0077.597] lstrlenW (lpString=".pub") returned 4
	[0077.597] lstrcmpiW (lpString1=".pub", lpString2=".cab") returned 1
	[0077.597] lstrlenW (lpString=".pwm") returned 4
	[0077.597] lstrcmpiW (lpString1=".pwm", lpString2=".cab") returned 1
	[0077.597] lstrlenW (lpString=".pxr") returned 4
	[0077.598] lstrcmpiW (lpString1=".pxr", lpString2=".cab") returned 1
	[0079.046] lstrcmpiW (lpString1=".1cd", lpString2=".mui") 
	[0079.046] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0079.047] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0079.047] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0079.047] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0079.047] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0079.048] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0079.048] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0079.048] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0079.048] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0079.048] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0079.049] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0079.049] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0079.049] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0079.049] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0079.049] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0079.050] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0079.051] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0079.052] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0079.053] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0079.053] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0079.053] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0079.053] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0079.053] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0079.054] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0079.054] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0079.054] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0079.054] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0079.054] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0079.055] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0079.055] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0079.055] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0079.055] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0079.055] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0079.056] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0079.056] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0079.056] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0079.056] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0079.056] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0079.057] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0079.057] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0079.057] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0079.057] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0079.058] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0079.058] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0079.058] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0079.058] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0079.058] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0079.059] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0079.059] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0079.059] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0079.059] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0079.060] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0079.060] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0079.060] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0079.060] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0079.060] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0079.061] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0079.061] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0079.061] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0079.062] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0079.062] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0079.062] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0079.062] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0079.062] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0079.063] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0079.063] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0079.063] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0079.063] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0079.064] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0079.064] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0079.064] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0079.064] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0079.065] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0079.065] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0079.065] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0079.065] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0079.066] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0079.066] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0079.066] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0079.067] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0079.067] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0079.067] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0079.067] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0079.068] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0079.068] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0079.068] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0079.068] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0079.068] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0079.069] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0079.069] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0079.069] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0079.069] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0079.070] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0079.070] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0079.070] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0079.070] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0079.071] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0079.071] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0079.071] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0079.071] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0079.071] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0079.072] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0079.072] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0079.072] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0079.072] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0079.072] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0079.073] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0079.073] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0079.073] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0079.073] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0079.074] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0079.074] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0079.074] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0079.074] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0079.075] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0079.075] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0079.075] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0079.075] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0079.075] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0079.076] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0079.076] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0079.076] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0079.076] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0079.077] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0080.996] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0080.997] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1
	[0080.997] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1
	[0080.997] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1
	[0080.997] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1
	[0080.997] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0080.998] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1
	[0080.998] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1
	[0080.998] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1
	[0080.998] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1
	[0080.998] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1
	[0080.998] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1
	[0080.999] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1
	[0080.999] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1
	[0080.999] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1
	[0080.999] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1
	[0080.999] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1
	[0081.000] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1
	[0081.000] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1
	[0081.000] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1
	[0081.000] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1
	[0081.000] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1
	[0081.001] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1
	[0081.001] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1
	[0081.001] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1
	[0081.001] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1
	[0081.001] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1
	[0081.001] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1
	[0081.002] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1
	[0081.002] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1
	[0081.002] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1
	[0081.002] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1
	[0081.002] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1
	[0081.003] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1
	[0081.003] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1
	[0081.003] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1
	[0081.003] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1
	[0081.003] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1
	[0081.004] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1
	[0081.004] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1
	[0081.004] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1
	[0081.004] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0081.004] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1
	[0081.004] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1
	[0081.005] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1
	[0081.005] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1
	[0081.005] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1
	[0081.005] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1
	[0081.005] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1
	[0081.006] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1
	[0081.006] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1
	[0081.006] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1
	[0081.006] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1
	[0081.006] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1
	[0081.006] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1
	[0081.007] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1
	[0081.007] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1
	[0081.007] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1
	[0081.007] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1
	[0081.007] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1
	[0081.008] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1
	[0081.008] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1
	[0081.008] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1
	[0081.008] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1
	[0081.008] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1
	[0081.009] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1
	[0081.009] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0081.009] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1
	[0081.009] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1
	[0081.009] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1
	[0081.009] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1
	[0081.010] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1
	[0081.010] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1
	[0081.010] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1
	[0081.010] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1
	[0081.010] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1
	[0081.011] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1
	[0081.011] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1
	[0081.011] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0081.011] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1
	[0081.011] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0081.012] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1
	[0081.012] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1
	[0081.012] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1
	[0081.012] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1
	[0081.012] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1
	[0081.013] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1
	[0081.013] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1
	[0081.013] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1
	[0081.013] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1
	[0081.013] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1
	[0081.014] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1
	[0081.014] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1
	[0081.014] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1
	[0081.014] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1
	[0081.014] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1
	[0081.014] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1
	[0081.015] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1
	[0081.015] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1
	[0081.015] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1
	[0081.015] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1
	[0081.016] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1
	[0081.016] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1
	[0081.016] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1
	[0081.016] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1
	[0081.016] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1
	[0081.016] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1
	[0081.017] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1
	[0081.017] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1
	[0081.017] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1
	[0081.017] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1
	[0081.018] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1
	[0081.018] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1
	[0081.018] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1
	[0081.018] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1
	[0081.018] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1
	[0081.019] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1
	[0081.019] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1
	[0081.019] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1
	[0081.019] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1
	[0081.019] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1
	[0081.020] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1
	[0081.020] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1
	[0081.020] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1
	[0081.020] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1
	[0081.021] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1
	[0081.021] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1
	[0081.021] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1
	[0081.021] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1
	[0081.021] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1
	[0081.022] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1
	[0081.022] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1
	[0081.022] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1
	[0081.022] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1
	[0081.023] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1
	[0081.023] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1
	[0081.023] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0081.023] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1
	[0081.023] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1
	[0081.024] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1
	[0081.024] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1
	[0081.024] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1
	[0081.024] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1
	[0081.025] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1
	[0081.025] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1
	[0081.025] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1
	[0081.025] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1
	[0081.025] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1
	[0081.026] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1
	[0081.026] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1
	[0081.026] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1
	[0081.026] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1
	[0081.026] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1
	[0081.027] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1
	[0081.027] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1
	[0081.027] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1
	[0081.028] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1
	[0081.028] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1
	[0081.028] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1
	[0081.028] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1
	[0081.028] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1
	[0081.029] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1
	[0081.029] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1
	[0081.029] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1
	[0081.029] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1
	[0081.030] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1
	[0081.030] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1
	[0081.030] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1
	[0081.030] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1
	[0081.030] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1
	[0081.031] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1
	[0081.031] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1
	[0081.031] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1
	[0081.031] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1
	[0081.031] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1
	[0081.032] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1
	[0081.032] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1
	[0081.032] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1
	[0081.032] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1
	[0081.032] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1
	[0081.033] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1
	[0081.033] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1
	[0081.033] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1
	[0081.033] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1
	[0081.033] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1
	[0081.034] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1
	[0081.034] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1
	[0081.034] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1
	[0081.034] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1
	[0081.035] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1
	[0081.035] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1
	[0081.035] lstrcmpiW (lpString1=".onetoc2", lpString2="eMUI.XML") returned -1
	[0081.035] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1
	[0081.035] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1
	[0081.036] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1
	[0081.036] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1
	[0081.036] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1
	[0081.036] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1
	[0081.036] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1
	[0081.036] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1
	[0081.037] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1
	[0081.037] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1
	[0081.037] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1
	[0081.037] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0081.037] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1
	[0081.038] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1
	[0081.038] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1
	[0081.038] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1
	[0081.038] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1
	[0081.038] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1
	[0081.039] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1
	[0081.039] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1
	[0081.039] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1
	[0081.039] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1
	[0081.039] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1
	[0081.040] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1
	[0081.040] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1
	[0081.040] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1
	[0081.040] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1
	[0081.040] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1
	[0081.041] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1
	[0081.041] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1
	[0081.041] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1
	[0081.041] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1
	[0081.041] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1
	[0081.042] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1
	[0081.042] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1
	[0081.042] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1
	[0081.042] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1
	[0099.049] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1

Thread:
	id = 21
	os_tid = 0x7b8


Process:
	id = "2"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x409cc000"
	os_pid = "0x1c0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x7b0"
	cmd_line = "\"C:\\Windows\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3
	os_tid = 0x5dc

	[0070.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf8b0 | out: lpSystemTimeAsFileTime=0x1cf8b0*(dwLowDateTime=0x3a133ad0, dwHighDateTime=0x1d68ccf)) 
	[0070.379] GetCurrentProcessId () returned 0x1c0
	[0070.379] GetCurrentThreadId () returned 0x5dc
	[0070.379] GetTickCount () returned 0x1148759
	[0070.379] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf8b8 | out: lpPerformanceCount=0x1cf8b8*=19079911571) returned 1
	[0070.409] GetModuleHandleW (lpModuleName=0x0) returned 0x4a350000
	[0070.433] __set_app_type (_Type=0x1) 
	[0070.434] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a377810) returned 0x0
	[0070.435] __getmainargs (in: _Argc=0x4a39a608, _Argv=0x4a39a618, _Env=0x4a39a610, _DoWildCard=0, _StartInfo=0x4a37e0f4 | out: _Argc=0x4a39a608, _Argv=0x4a39a618, _Env=0x4a39a610) returned 0
	[0070.435] GetCurrentThreadId () returned 0x5dc
	[0070.435] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5dc) returned 0x3c
	[0070.602] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000
	[0070.602] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40
	[0070.602] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0070.603] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0070.603] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf848 | out: phkResult=0x1cf848*=0x0) returned 0x2
	[0070.603] VirtualQuery (in: lpAddress=0x1cf830, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0070.603] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0070.604] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0070.604] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0070.604] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0070.604] GetConsoleOutputCP () returned 0x1b5
	[0070.604] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a38bfe0 | out: lpCPInfo=0x4a38bfe0) returned 1
	[0070.606] SetConsoleCtrlHandler (HandlerRoutine=0x4a373184, Add=1) returned 1
	[0070.606] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.606] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0070.607] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.607] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a37e194 | out: lpMode=0x4a37e194) returned 0
	[0070.607] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.607] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a37e198 | out: lpMode=0x4a37e198) returned 0
	[0070.608] GetEnvironmentStringsW () returned 0x378a60*
	[0070.608] GetProcessHeap () returned 0x360000
	[0070.608] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xa7c) returned 0x3794f0
	[0070.609] FreeEnvironmentStringsW (penv=0x378a60) returned 1
	[0070.609] GetProcessHeap () returned 0x360000
	[0070.609] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x8) returned 0x3788e0
	[0070.609] GetEnvironmentStringsW () returned 0x378a60*
	[0070.610] GetProcessHeap () returned 0x360000
	[0070.610] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xa7c) returned 0x379f80
	[0070.610] FreeEnvironmentStringsW (penv=0x378a60) returned 1
	[0070.611] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce708 | out: phkResult=0x1ce708*=0x44) returned 0x0
	[0070.611] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x18, lpcbData=0x1ce704*=0x1000) returned 0x2
	[0070.611] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.611] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x1000) returned 0x2
	[0070.612] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x0, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.612] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.612] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.612] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x1000) returned 0x2
	[0070.612] RegCloseKey (hKey=0x44) returned 0x0
	[0070.613] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce708 | out: phkResult=0x1ce708*=0x44) returned 0x0
	[0070.613] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x1000) returned 0x2
	[0070.613] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.613] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x1000) returned 0x2
	[0070.613] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x0, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.614] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x9, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.614] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x9, lpcbData=0x1ce704*=0x4) returned 0x0
	[0070.614] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x9, lpcbData=0x1ce704*=0x1000) returned 0x2
	[0070.614] RegCloseKey (hKey=0x44) returned 0x0
	[0070.614] time (in: timer=0x0 | out: timer=0x0) returned 0x5f6322b7
	[0070.614] srand (_Seed=0x5f6322b7) 
	[0070.615] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0070.615] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0070.615] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a38c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0070.616] GetProcessHeap () returned 0x360000
	[0070.616] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x37aa10
	[0070.616] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x37aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0070.617] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0070.617] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0070.617] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0070.617] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0070.617] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0070.617] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0070.618] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0070.618] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0070.618] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0070.618] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0070.618] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0070.619] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0070.619] GetProcessHeap () returned 0x360000
	[0070.619] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3794f0 | out: hHeap=0x360000) returned 1
	[0070.619] GetEnvironmentStringsW () returned 0x378a60*
	[0070.619] GetProcessHeap () returned 0x360000
	[0070.619] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xa94) returned 0x37ac30
	[0070.620] FreeEnvironmentStringsW (penv=0x378a60) returned 1
	[0070.620] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0070.620] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0070.621] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0070.621] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0070.621] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0070.621] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0070.621] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0070.621] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0070.622] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0070.622] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0070.622] GetProcessHeap () returned 0x360000
	[0070.623] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x5c) returned 0x37b6d0
	[0070.623] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf510 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0070.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf510, lpFilePart=0x1cf4f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf4f0*="Desktop") returned 0x25
	[0070.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0070.624] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf220 | out: lpFindFileData=0x1cf220*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x37b740
	[0070.624] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1
	[0070.625] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1cf220 | out: lpFindFileData=0x1cf220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x37b740
	[0070.625] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1
	[0070.625] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0070.625] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1cf220 | out: lpFindFileData=0x1cf220*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2decd900, ftLastAccessTime.dwHighDateTime=0x1d68ccf, ftLastWriteTime.dwLowDateTime=0x2decd900, ftLastWriteTime.dwHighDateTime=0x1d68ccf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x37b740
	[0070.626] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1
	[0070.626] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0070.626] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0070.627] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0070.627] GetProcessHeap () returned 0x360000
	[0070.627] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ac30 | out: hHeap=0x360000) returned 1
	[0070.627] GetEnvironmentStringsW () returned 0x37b740*
	[0070.628] GetProcessHeap () returned 0x360000
	[0070.628] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xae8) returned 0x37c230
	[0070.628] FreeEnvironmentStringsW (penv=0x37b740) returned 1
	[0070.628] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a38c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0070.628] GetProcessHeap () returned 0x360000
	[0070.628] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37b6d0 | out: hHeap=0x360000) returned 1
	[0070.629] GetProcessHeap () returned 0x360000
	[0070.629] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x4016) returned 0x37cd20
	[0070.630] GetProcessHeap () returned 0x360000
	[0070.630] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20 | out: hHeap=0x360000) returned 1
	[0070.630] GetConsoleOutputCP () returned 0x1b5
	[0070.630] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a38bfe0 | out: lpCPInfo=0x4a38bfe0) returned 1
	[0070.630] GetUserDefaultLCID () returned 0x409
	[0070.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a387b50, cchData=8 | out: lpLCData=":") returned 2
	[0070.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf620, cchData=128 | out: lpLCData="0") returned 2
	[0070.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf620, cchData=128 | out: lpLCData="0") returned 2
	[0070.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf620, cchData=128 | out: lpLCData="1") returned 2
	[0070.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a39a740, cchData=8 | out: lpLCData="/") returned 2
	[0070.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a39a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0070.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a39a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0070.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a39a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0070.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a39a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0070.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a39a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0070.634] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a39a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0070.634] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a39a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0070.634] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a387b40, cchData=8 | out: lpLCData=".") returned 2
	[0070.634] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a39a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0070.634] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0070.636] GetProcessHeap () returned 0x360000
	[0070.636] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x20c) returned 0x3795c0
	[0070.636] GetConsoleTitleW (in: lpConsoleTitle=0x3795c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0070.637] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.638] GetFileType (hFile=0xf4) returned 0x3
	[0070.638] BrandingFormatString () returned 0x3797e0
	[0070.644] GetVersion () returned 0x1db10106
	[0070.644] _vsnwprintf (in: _Buffer=0x1cf790, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1cf728 | out: _Buffer="6.1.7601") returned 8
	[0070.644] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.644] GetFileType (hFile=0xf4) returned 0x3
	[0070.644] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a396340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0070.645] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a396340, nSize=0x2000, Arguments=0x1cf730 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24
	[0070.645] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.645] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37
	[0070.645] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1cf6b8, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf6b8*=0x24, lpOverlapped=0x0) returned 1
	[0070.646] _vsnwprintf (in: _Buffer=0x4a396340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf758 | out: _Buffer="\r\n") returned 2
	[0070.646] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.646] GetFileType (hFile=0xf4) returned 0x3
	[0070.646] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.646] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0070.646] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf728, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf728*=0x2, lpOverlapped=0x0) returned 1
	[0070.647] _vsnwprintf (in: _Buffer=0x4a396340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1cf758 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.") returned 63
	[0070.647] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.647] GetFileType (hFile=0xf4) returned 0x3
	[0070.647] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.647] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", lpUsedDefaultChar=0x0) returned 64
	[0070.648] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1cf728, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf728*=0x3f, lpOverlapped=0x0) returned 1
	[0070.648] _vsnwprintf (in: _Buffer=0x4a396340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf758 | out: _Buffer="\r\n") returned 2
	[0070.648] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.648] GetFileType (hFile=0xf4) returned 0x3
	[0070.648] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.648] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0070.649] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf728, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf728*=0x2, lpOverlapped=0x0) returned 1
	[0070.659] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000
	[0070.660] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0
	[0070.660] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290
	[0070.661] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0
	[0070.661] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.661] GetFileType (hFile=0xe8) returned 0x3
	[0070.662] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0070.662] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1cf580 | out: TokenHandle=0x1cf580*=0x0) returned 0xc000007c
	[0070.662] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1cf580 | out: TokenHandle=0x1cf580*=0x50) returned 0x0
	[0070.662] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1cf590, TokenInformationLength=0x4, ReturnLength=0x1cf598 | out: TokenInformation=0x1cf590, ReturnLength=0x1cf598) returned 0x0
	[0070.662] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1cf598, TokenInformationLength=0x4, ReturnLength=0x1cf590 | out: TokenInformation=0x1cf598, ReturnLength=0x1cf590) returned 0x0
	[0070.663] NtClose (Handle=0x50) returned 0x0
	[0070.663] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1cf560, nSize=0x0, Arguments=0x1cf568 | out: lpBuffer="韠7") returned 0xf
	[0070.663] GetProcessHeap () returned 0x360000
	[0070.663] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x361ab0
	[0070.664] GetConsoleTitleW (in: lpConsoleTitle=0x1cf5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0070.664] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0070.664] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1
	[0070.666] GetProcessHeap () returned 0x360000
	[0070.666] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x361ab0 | out: hHeap=0x360000) returned 1
	[0070.666] LocalFree (hMem=0x3797e0) returned 0x0
	[0070.666] GetProcessHeap () returned 0x360000
	[0070.666] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37aa10 | out: hHeap=0x360000) returned 1
	[0070.668] _vsnwprintf (in: _Buffer=0x4a396340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf298 | out: _Buffer="\r\n") returned 2
	[0070.668] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.668] GetFileType (hFile=0xf4) returned 0x3
	[0070.668] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.668] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0070.669] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf268, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf268*=0x2, lpOverlapped=0x0) returned 1
	[0070.669] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0070.669] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a38c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0070.669] _vsnwprintf (in: _Buffer=0x4a37eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37
	[0070.670] _vsnwprintf (in: _Buffer=0x4a37ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1cf2a8 | out: _Buffer=">") returned 1
	[0070.670] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.670] GetFileType (hFile=0xf4) returned 0x3
	[0070.671] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.671] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39
	[0070.671] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1cf298, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf298*=0x26, lpOverlapped=0x0) returned 1
	[0070.671] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.671] GetFileType (hFile=0xe8) returned 0x3
	[0070.672] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0070.675] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.675] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.675] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0070.675] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.675] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.676] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0070.676] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.676] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.676] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0070.677] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.677] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.677] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0070.678] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.678] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.678] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0070.678] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.678] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.679] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.679] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0070.679] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.679] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.679] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0070.680] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.680] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.680] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0070.681] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.681] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.681] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0070.681] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.681] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.682] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0070.682] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.682] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.682] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0070.683] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.683] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.683] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.683] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0070.684] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.684] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.685] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0070.685] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.685] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.686] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0070.686] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.686] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.686] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0070.687] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.687] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.687] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0070.687] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.688] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.688] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0070.688] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.688] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.689] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.689] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0070.689] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.689] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.689] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0070.690] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.690] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.690] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0070.690] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.691] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.691] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.691] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0070.691] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.691] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.692] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0070.692] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.692] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.692] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0070.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0070.696] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.696] GetFileType (hFile=0xe8) returned 0x3
	[0070.697] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0070.697] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.697] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.697] GetFileType (hFile=0xf4) returned 0x3
	[0070.697] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0070.697] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0070.698] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1cf578, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf578*=0x18, lpOverlapped=0x0) returned 1
	[0070.698] GetProcessHeap () returned 0x360000
	[0070.698] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x4012) returned 0x37cd20
	[0070.698] GetProcessHeap () returned 0x360000
	[0070.698] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd20 | out: hHeap=0x360000) returned 1
	[0070.701] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0070.701] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0070.701] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0070.701] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0070.702] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0070.702] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0070.702] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0070.702] GetProcessHeap () returned 0x360000
	[0070.702] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0) returned 0x3797e0
	[0070.702] GetProcessHeap () returned 0x360000
	[0070.703] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x1a) returned 0x374610
	[0070.706] GetProcessHeap () returned 0x360000
	[0070.706] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x38) returned 0x376510
	[0070.711] GetConsoleOutputCP () returned 0x1b5
	[0070.717] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a38bfe0 | out: lpCPInfo=0x4a38bfe0) returned 1
	[0070.717] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0070.718] GetConsoleTitleW (in: lpConsoleTitle=0x1cf530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0070.719] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0070.720] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0070.720] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0070.720] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0070.720] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0070.720] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0070.720] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0070.721] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0070.721] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0070.721] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0070.721] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0070.721] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0070.721] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0070.721] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0070.722] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0070.722] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0070.722] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0070.722] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0070.722] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0070.722] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0070.723] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0070.723] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0070.723] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0070.723] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0070.723] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0070.724] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0070.724] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0070.724] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0070.724] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0070.724] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0070.724] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0070.724] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0070.725] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0070.725] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0070.725] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0070.725] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0070.725] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0070.725] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0070.726] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0070.726] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0070.726] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0070.726] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0070.726] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0070.726] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0070.726] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0070.727] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0070.727] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0070.727] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0070.727] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0070.727] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0070.727] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0070.728] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0070.728] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0070.728] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0070.728] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0070.728] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0070.728] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0070.728] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0070.729] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0070.729] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0070.729] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0070.729] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0070.729] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0070.729] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0070.729] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0070.730] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0070.730] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0070.730] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0070.730] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0070.730] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0070.730] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0070.730] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0070.731] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0070.731] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0070.731] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0070.731] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0070.731] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0070.731] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0070.732] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0070.732] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0070.732] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0070.732] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0070.732] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0070.732] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0070.732] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0070.733] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0070.733] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0070.734] GetProcessHeap () returned 0x360000
	[0070.734] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x361ab0
	[0070.734] GetProcessHeap () returned 0x360000
	[0070.734] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x42) returned 0x3798a0
	[0070.735] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0070.735] GetProcessHeap () returned 0x360000
	[0070.736] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x420) returned 0x379a80
	[0070.736] SetErrorMode (uMode=0x0) returned 0x0
	[0070.736] SetErrorMode (uMode=0x1) returned 0x0
	[0070.736] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x379a90, lpFilePart=0x1cedc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cedc0*="Desktop") returned 0x25
	[0070.737] SetErrorMode (uMode=0x0) returned 0x1
	[0070.737] GetProcessHeap () returned 0x360000
	[0070.737] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379a80, Size=0x66) returned 0x379a80
	[0070.737] GetProcessHeap () returned 0x360000
	[0070.737] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379a80) returned 0x66
	[0070.738] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0070.738] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0070.739] GetProcessHeap () returned 0x360000
	[0070.739] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x128) returned 0x361cd0
	[0070.739] GetProcessHeap () returned 0x360000
	[0070.739] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x240) returned 0x379b00
	[0070.784] GetProcessHeap () returned 0x360000
	[0070.784] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379b00, Size=0x12a) returned 0x379b00
	[0070.784] GetProcessHeap () returned 0x360000
	[0070.784] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379b00) returned 0x12a
	[0070.785] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0070.785] GetProcessHeap () returned 0x360000
	[0070.785] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xe8) returned 0x375b70
	[0070.785] GetProcessHeap () returned 0x360000
	[0070.785] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x375b70, Size=0x7e) returned 0x375b70
	[0070.786] GetProcessHeap () returned 0x360000
	[0070.786] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x375b70) returned 0x7e
	[0070.828] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.828] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0xffffffffffffffff
	[0070.829] GetLastError () returned 0x2
	[0070.829] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0xffffffffffffffff
	[0070.829] GetLastError () returned 0x2
	[0070.830] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0070.830] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0x375c00
	[0070.830] GetProcessHeap () returned 0x360000
	[0070.830] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x28) returned 0x374640
	[0070.831] FindClose (in: hFindFile=0x375c00 | out: hFindFile=0x375c00) returned 1
	[0070.831] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0x375c00
	[0070.831] GetProcessHeap () returned 0x360000
	[0070.831] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x374640, Size=0x8) returned 0x3798f0
	[0070.832] FindClose (in: hFindFile=0x375c00 | out: hFindFile=0x375c00) returned 1
	[0070.832] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0070.832] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0070.832] GetConsoleTitleW (in: lpConsoleTitle=0x1cf080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0070.833] GetProcessHeap () returned 0x360000
	[0070.833] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x21c) returned 0x379c40
	[0070.833] GetConsoleTitleW (in: lpConsoleTitle=0x379c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0070.833] GetProcessHeap () returned 0x360000
	[0070.833] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379c40, Size=0xa8) returned 0x379c40
	[0070.833] GetProcessHeap () returned 0x360000
	[0070.833] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379c40) returned 0xa8
	[0070.834] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0070.835] GetProcessHeap () returned 0x360000
	[0070.835] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379c40 | out: hHeap=0x360000) returned 1
	[0070.835] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cedf8 | out: lpAttributeList=0x1cee38, lpSize=0x1cedf8) returned 1
	[0070.835] UpdateProcThreadAttribute (in: lpAttributeList=0x1cee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cee38, lpPreviousValue=0x0) returned 1
	[0070.835] GetStartupInfoW (in: lpStartupInfo=0x1cef50 | out: lpStartupInfo=0x1cef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0070.836] GetProcessHeap () returned 0x360000
	[0070.836] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x20) returned 0x374640
	[0070.836] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0070.836] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0070.836] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0070.836] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.837] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.837] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0070.837] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0070.837] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0070.837] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0070.837] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0070.837] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.838] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0070.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0070.839] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0070.840] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0070.840] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0070.878] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0070.879] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0070.879] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0070.879] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0070.879] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0070.879] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0070.880] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0070.880] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0070.880] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0070.880] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0070.880] GetProcessHeap () returned 0x360000
	[0070.880] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374640 | out: hHeap=0x360000) returned 1
	[0070.880] GetProcessHeap () returned 0x360000
	[0070.881] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x12) returned 0x378900
	[0070.881] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1cee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cee20 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0x1cee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x3b4, dwThreadId=0x434)) returned 1
	[0071.330] CloseHandle (hObject=0x50) returned 1
	[0071.330] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0071.331] GetProcessHeap () returned 0x360000
	[0071.331] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c230 | out: hHeap=0x360000) returned 1
	[0071.331] GetEnvironmentStringsW () returned 0x37aa10*
	[0071.331] GetProcessHeap () returned 0x360000
	[0071.331] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xae8) returned 0x37b500
	[0071.331] FreeEnvironmentStringsW (penv=0x37aa10) returned 1
	[0071.332] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000
	[0071.333] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0
	[0071.333] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1ce728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1ce728, ReturnLength=0x0) returned 0x0
	[0071.333] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1ce760, nSize=0x380, lpNumberOfBytesRead=0x1ce720 | out: lpBuffer=0x1ce760*, lpNumberOfBytesRead=0x1ce720*=0x380) returned 1
	[0071.333] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0072.385] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1ced68 | out: lpExitCode=0x1ced68*=0x0) returned 1
	[0072.385] CloseHandle (hObject=0x54) returned 1
	[0072.385] _vsnwprintf (in: _Buffer=0x1cefd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ced78 | out: _Buffer="00000000") returned 8
	[0072.386] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0072.386] GetProcessHeap () returned 0x360000
	[0072.386] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37b500 | out: hHeap=0x360000) returned 1
	[0072.386] GetEnvironmentStringsW () returned 0x37aa10*
	[0072.386] GetProcessHeap () returned 0x360000
	[0072.386] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0e) returned 0x37eb10
	[0072.387] FreeEnvironmentStringsW (penv=0x37aa10) returned 1
	[0072.387] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0072.387] GetProcessHeap () returned 0x360000
	[0072.387] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37eb10 | out: hHeap=0x360000) returned 1
	[0072.387] GetEnvironmentStringsW () returned 0x37aa10*
	[0072.388] GetProcessHeap () returned 0x360000
	[0072.388] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0e) returned 0x37eb10
	[0072.389] FreeEnvironmentStringsW (penv=0x37aa10) returned 1
	[0072.389] GetProcessHeap () returned 0x360000
	[0072.389] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x378900 | out: hHeap=0x360000) returned 1
	[0072.389] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cee38 | out: lpAttributeList=0x1cee38) 
	[0072.394] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1
	[0072.395] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.395] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0072.395] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.396] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a37e194 | out: lpMode=0x4a37e194) returned 0
	[0072.396] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.396] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a37e198 | out: lpMode=0x4a37e198) returned 0
	[0072.396] GetConsoleOutputCP () returned 0x4e3
	[0072.397] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a38bfe0 | out: lpCPInfo=0x4a38bfe0) returned 1
	[0072.397] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0072.398] GetProcessHeap () returned 0x360000
	[0072.398] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375b70 | out: hHeap=0x360000) returned 1
	[0072.398] GetProcessHeap () returned 0x360000
	[0072.398] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379b00 | out: hHeap=0x360000) returned 1
	[0072.399] GetProcessHeap () returned 0x360000
	[0072.399] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x361cd0 | out: hHeap=0x360000) returned 1
	[0072.399] GetProcessHeap () returned 0x360000
	[0072.399] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379a80 | out: hHeap=0x360000) returned 1
	[0072.399] GetProcessHeap () returned 0x360000
	[0072.399] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3798a0 | out: hHeap=0x360000) returned 1
	[0072.400] GetProcessHeap () returned 0x360000
	[0072.400] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x361ab0 | out: hHeap=0x360000) returned 1
	[0072.400] GetProcessHeap () returned 0x360000
	[0072.400] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x376510 | out: hHeap=0x360000) returned 1
	[0072.401] GetProcessHeap () returned 0x360000
	[0072.401] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374610 | out: hHeap=0x360000) returned 1
	[0072.401] GetProcessHeap () returned 0x360000
	[0072.401] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3797e0 | out: hHeap=0x360000) returned 1
	[0072.402] _vsnwprintf (in: _Buffer=0x4a396340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf298 | out: _Buffer="\r\n") returned 2
	[0072.402] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.402] GetFileType (hFile=0xf4) returned 0x3
	[0072.402] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.403] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0072.403] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf268, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf268*=0x2, lpOverlapped=0x0) returned 1
	[0072.403] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0072.403] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a38c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0072.404] _vsnwprintf (in: _Buffer=0x4a37eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37
	[0072.405] _vsnwprintf (in: _Buffer=0x4a37ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1cf2a8 | out: _Buffer=">") returned 1
	[0072.405] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.405] GetFileType (hFile=0xf4) returned 0x3
	[0072.405] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.405] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39
	[0072.406] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1cf298, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf298*=0x26, lpOverlapped=0x0) returned 1
	[0072.406] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.406] GetFileType (hFile=0xe8) returned 0x3
	[0072.407] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0072.408] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0072.408] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0072.409] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0072.410] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.411] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0072.411] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.411] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.411] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0072.412] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.412] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.412] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0072.412] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.413] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.413] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.413] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0072.413] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.413] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.414] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.414] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0072.414] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.414] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.415] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.415] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0072.415] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.415] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.440] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.440] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0072.440] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.440] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.441] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.441] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0072.441] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.441] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.441] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.441] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0072.442] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.442] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.442] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.442] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0072.442] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.443] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.443] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.443] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0072.443] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.443] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.444] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.444] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0072.444] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.444] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.444] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.444] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0072.445] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.445] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.445] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.445] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0072.445] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.446] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.446] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.446] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0072.446] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.446] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.446] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.448] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0072.448] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.448] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.449] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.449] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0072.449] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.449] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.450] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0072.450] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.450] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.450] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.450] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0072.451] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.451] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.451] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.451] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0072.451] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.452] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.452] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.452] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0072.452] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.452] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.452] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.453] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0072.453] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.453] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.453] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.453] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0072.454] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.454] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.454] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.454] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0072.454] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.455] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.455] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.455] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0072.455] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.455] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.456] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.456] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0072.456] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.456] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.457] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.457] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0072.457] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.457] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.457] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.458] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0072.458] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.458] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.458] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.458] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0072.459] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.459] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.459] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.459] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0072.459] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.460] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.460] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.460] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0072.460] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.460] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.461] ReadFile (in: hFile=0xe8, lpBuffer=0x4a38c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesRead=0x1cf598*=0x1, lpOverlapped=0x0) returned 1
	[0072.461] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a38c320, cbMultiByte=1, lpWideCharStr=0x4a38e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0072.461] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.461] GetFileType (hFile=0xe8) returned 0x3
	[0072.461] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0072.462] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0072.462] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.462] GetFileType (hFile=0xf4) returned 0x3
	[0072.462] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0072.463] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a38c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0072.463] WriteFile (in: hFile=0xf4, lpBuffer=0x4a38c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1cf578, lpOverlapped=0x0 | out: lpBuffer=0x4a38c320*, lpNumberOfBytesWritten=0x1cf578*=0x24, lpOverlapped=0x0) returned 1
	[0072.463] GetProcessHeap () returned 0x360000
	[0072.463] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x4012) returned 0x37f630
	[0072.464] GetProcessHeap () returned 0x360000
	[0072.464] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37f630 | out: hHeap=0x360000) returned 1
	[0072.465] GetProcessHeap () returned 0x360000
	[0072.465] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0) returned 0x3797e0
	[0072.465] GetProcessHeap () returned 0x360000
	[0072.465] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x22) returned 0x374610
	[0072.469] GetProcessHeap () returned 0x360000
	[0072.469] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x48) returned 0x37aa90
	[0072.471] GetConsoleOutputCP () returned 0x4e3
	[0072.471] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a38bfe0 | out: lpCPInfo=0x4a38bfe0) returned 1
	[0072.471] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0072.472] GetConsoleTitleW (in: lpConsoleTitle=0x1cf530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0072.472] GetProcessHeap () returned 0x360000
	[0072.472] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x218) returned 0x379910
	[0072.473] GetProcessHeap () returned 0x360000
	[0072.473] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x5a) returned 0x379b30
	[0072.473] GetProcessHeap () returned 0x360000
	[0072.473] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x420) returned 0x379090
	[0072.473] SetErrorMode (uMode=0x0) returned 0x0
	[0072.474] SetErrorMode (uMode=0x1) returned 0x0
	[0072.474] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3790a0, lpFilePart=0x1cedc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cedc0*="Desktop") returned 0x25
	[0072.474] SetErrorMode (uMode=0x0) returned 0x1
	[0072.474] GetProcessHeap () returned 0x360000
	[0072.475] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379090, Size=0x6e) returned 0x379090
	[0072.475] GetProcessHeap () returned 0x360000
	[0072.475] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379090) returned 0x6e
	[0072.475] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0072.476] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0072.476] GetProcessHeap () returned 0x360000
	[0072.476] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x128) returned 0x375b70
	[0072.476] GetProcessHeap () returned 0x360000
	[0072.476] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x240) returned 0x361ab0
	[0072.476] GetProcessHeap () returned 0x360000
	[0072.477] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x361ab0, Size=0x12a) returned 0x361ab0
	[0072.477] GetProcessHeap () returned 0x360000
	[0072.477] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x361ab0) returned 0x12a
	[0072.477] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a37f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0072.477] GetProcessHeap () returned 0x360000
	[0072.477] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xe8) returned 0x379db0
	[0072.477] GetProcessHeap () returned 0x360000
	[0072.478] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379db0, Size=0x7e) returned 0x379db0
	[0072.478] GetProcessHeap () returned 0x360000
	[0072.478] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379db0) returned 0x7e
	[0072.479] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.479] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0xffffffffffffffff
	[0072.480] GetLastError () returned 0x2
	[0072.480] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0xffffffffffffffff
	[0072.480] GetLastError () returned 0x2
	[0072.481] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.481] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0x379ba0
	[0072.482] FindClose (in: hFindFile=0x379ba0 | out: hFindFile=0x379ba0) returned 1
	[0072.482] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0xffffffffffffffff
	[0072.483] GetLastError () returned 0x2
	[0072.483] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ceb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb30) returned 0x379ba0
	[0072.483] FindClose (in: hFindFile=0x379ba0 | out: hFindFile=0x379ba0) returned 1
	[0072.484] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0072.484] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0072.484] GetConsoleTitleW (in: lpConsoleTitle=0x1cf080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0072.586] GetProcessHeap () returned 0x360000
	[0072.586] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x21c) returned 0x379110
	[0072.587] GetConsoleTitleW (in: lpConsoleTitle=0x379120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0072.587] GetProcessHeap () returned 0x360000
	[0072.587] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x379110, Size=0xc0) returned 0x379110
	[0072.588] GetProcessHeap () returned 0x360000
	[0072.588] RtlSizeHeap (HeapHandle=0x360000, Flags=0x0, MemoryPointer=0x379110) returned 0xc0
	[0072.588] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0072.589] GetProcessHeap () returned 0x360000
	[0072.589] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379110 | out: hHeap=0x360000) returned 1
	[0072.589] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cedf8 | out: lpAttributeList=0x1cee38, lpSize=0x1cedf8) returned 1
	[0072.590] UpdateProcThreadAttribute (in: lpAttributeList=0x1cee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cee38, lpPreviousValue=0x0) returned 1
	[0072.590] GetStartupInfoW (in: lpStartupInfo=0x1cef50 | out: lpStartupInfo=0x1cef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0072.590] GetProcessHeap () returned 0x360000
	[0072.590] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x20) returned 0x374640
	[0072.591] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0072.591] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0072.591] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0072.591] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0072.591] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0072.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0072.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0072.592] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0072.592] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0072.592] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0072.592] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0072.592] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0072.593] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0072.593] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0072.593] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0072.593] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0072.593] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0072.593] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0072.593] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0072.594] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0072.595] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0072.595] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0072.595] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0072.595] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0072.595] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0072.595] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0072.595] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0072.596] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0072.596] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0072.596] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0072.596] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0072.596] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0072.596] GetProcessHeap () returned 0x360000
	[0072.597] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374640 | out: hHeap=0x360000) returned 1
	[0072.597] GetProcessHeap () returned 0x360000
	[0072.597] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x12) returned 0x378900
	[0072.597] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1cee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cee20 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0x1cee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x5ac, dwThreadId=0x55c)) returned 1
	[0072.609] CloseHandle (hObject=0x54) returned 1
	[0072.609] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0072.609] GetProcessHeap () returned 0x360000
	[0072.609] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37eb10 | out: hHeap=0x360000) returned 1
	[0072.609] GetEnvironmentStringsW () returned 0x37eb10*
	[0072.610] GetProcessHeap () returned 0x360000
	[0072.610] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0xb0e) returned 0x37f630
	[0072.610] FreeEnvironmentStringsW (penv=0x37eb10) returned 1
	[0072.610] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1ce728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1ce728, ReturnLength=0x0) returned 0x0
	[0072.611] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x1ce760, nSize=0x380, lpNumberOfBytesRead=0x1ce720 | out: lpBuffer=0x1ce760*, lpNumberOfBytesRead=0x1ce720*=0x380) returned 1
	[0072.611] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) 

Process:
	id = "3"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x3e082000"
	os_pid = "0x3b4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x1c0"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 8
	os_tid = 0x434


Process:
	id = "4"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x3e793000"
	os_pid = "0x5ac"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x1c0"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 20
	os_tid = 0x55c


Thread:
	id = 22
	os_tid = 0x43c


Thread:
	id = 23
	os_tid = 0x6fc


Thread:
	id = 24
	os_tid = 0x80c


Thread:
	id = 25
	os_tid = 0x81c


Process:
	id = "5"
	image_name = "vssvc.exe"
	filename = "c:\\windows\\system32\\vssvc.exe"
	page_root = "0x3dc2d000"
	os_pid = "0x84c"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b7e890"
	monitor_reason = "rpc_server"
	parent_id = "4"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\system32\\vssvc.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:000593ce" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 26
	os_tid = 0x8bc


Thread:
	id = 27
	os_tid = 0x8ac


Thread:
	id = 28
	os_tid = 0x89c


Thread:
	id = 29
	os_tid = 0x88c


Thread:
	id = 30
	os_tid = 0x87c


Thread:
	id = 31
	os_tid = 0x86c


Thread:
	id = 32
	os_tid = 0x85c


Thread:
	id = 33
	os_tid = 0x8cc


Thread:
	id = 40
	os_tid = 0xae4


Process:
	id = "6"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x37033000"
	os_pid = "0x8ec"
	os_integrity_level = "0x4000"
	os_privileges = "0x60814080"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005a087" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 34
	os_tid = 0x954


Thread:
	id = 35
	os_tid = 0x93c


Thread:
	id = 36
	os_tid = 0x92c


Thread:
	id = 37
	os_tid = 0x91c


Thread:
	id = 38
	os_tid = 0x90c


Thread:
	id = 39
	os_tid = 0x8fc